#600: M1628076 M1632241 M1595886 M1614468

devtools/client/shared/Curl.jsm

@@ -92,7 +92,10 @@ this.Curl = {
     let data = [];
     if (utils.isUrlEncodedRequest(aData) || aData.method == "PUT") {
       postDataText = aData.postDataText;
-      addPostData("--data");
+      // Irony: curl that comes with Tiger doesn't support this option.
+      // But if you are l33t enough to use this, you should know that.
+      // -- Cameron
+      addPostData("--data-raw");
       addPostData(utils.writePostDataTextParams(postDataText));
       ignoredHeaders.add("Content-Length");
     } else if (multipartRequest) {

dom/cache/Manager.cpp

@@ -253,6 +253,12 @@ public:
     MOZ_ASSERT(!sFactory->mManagerList.IsEmpty());
 
     {
+      // Note that we are synchronously calling abort code here.  If any
+      // of the shutdown code synchronously decides to delete the Factory
+      // we need to delay that delete until the end of this method.
+      AutoRestore<bool> restore(sFactory->mInSyncAbortOrShutdown);
+      sFactory->mInSyncAbortOrShutdown = true;
+
       ManagerList::ForwardIterator iter(sFactory->mManagerList);
       while (iter.HasMore()) {
         RefPtr<Manager> manager = iter.GetNext();
@@ -262,6 +268,8 @@ public:
         }
       }
     }
+
+    MaybeDestroyInstance();
   }
 
   static void
@@ -279,8 +287,8 @@ public:
       // Note that we are synchronously calling shutdown code here.  If any
       // of the shutdown code synchronously decides to delete the Factory
       // we need to delay that delete until the end of this method.
-      AutoRestore<bool> restore(sFactory->mInSyncShutdown);
-      sFactory->mInSyncShutdown = true;
+      AutoRestore<bool> restore(sFactory->mInSyncAbortOrShutdown);
+      sFactory->mInSyncAbortOrShutdown = true;
 
       ManagerList::ForwardIterator iter(sFactory->mManagerList);
       while (iter.HasMore()) {
@@ -300,17 +308,14 @@ public:
   }
 
 private:
-  Factory()
-    : mInSyncShutdown(false)
-  {
+  Factory() : mInSyncAbortOrShutdown(false) {
     MOZ_COUNT_CTOR(cache::Manager::Factory);
   }
 
-  ~Factory()
-  {
+  ~Factory() {
     MOZ_COUNT_DTOR(cache::Manager::Factory);
-    MOZ_ASSERT(mManagerList.IsEmpty());
-    MOZ_ASSERT(!mInSyncShutdown);
+    MOZ_DIAGNOSTIC_ASSERT(mManagerList.IsEmpty());
+    MOZ_DIAGNOSTIC_ASSERT(!mInSyncAbortOrShutdown);
   }
 
   static nsresult
@@ -353,9 +358,9 @@ private:
 
     // If the factory is is still in use then we cannot delete yet.  This
     // could be due to managers still existing or because we are in the
-    // middle of shutting down.  We need to be careful not to delete ourself
-    // synchronously during shutdown.
-    if (!sFactory->mManagerList.IsEmpty() || sFactory->mInSyncShutdown) {
+    // middle of aborting or shutting down. We need to be careful not to delete
+    // ourself synchronously during shutdown.
+    if (!sFactory->mManagerList.IsEmpty() || sFactory->mInSyncAbortOrShutdown) {
       return;
     }
 
@@ -380,10 +385,10 @@ private:
   typedef nsTObserverArray<Manager*> ManagerList;
   ManagerList mManagerList;
 
-  // This flag is set when we are looping through the list and calling
-  // Shutdown() on each Manager.  We need to be careful not to synchronously
+  // This flag is set when we are looping through the list and calling Abort()
+  // or Shutdown() on each Manager.  We need to be careful not to synchronously
   // trigger the deletion of the factory while still executing this loop.
-  bool mInSyncShutdown;
+  bool mInSyncAbortOrShutdown;
 };
 
 // static

netwerk/sctp/src/netinet/sctp_input.c

@@ -2073,7 +2073,7 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
 	int init_offset, initack_offset, initack_limit;
 	int retval;
 	int error = 0;
-	uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
+	uint8_t auth_chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 	struct socket *so;
 
@@ -2264,8 +2264,12 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
 	if (auth_skipped) {
 		struct sctp_auth_chunk *auth;
 
-		auth = (struct sctp_auth_chunk *)
-		    sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
+		if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
+			auth = (struct sctp_auth_chunk *)
+				sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
+		} else {
+			auth = NULL;
+		}
 		if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
 			/* auth HMAC failed, dump the assoc and packet */
 			SCTPDBG(SCTP_DEBUG_AUTH1,
@@ -4655,11 +4659,15 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
 			if (auth_skipped && (stcb != NULL)) {
 				struct sctp_auth_chunk *auth;
 
-				auth = (struct sctp_auth_chunk *)
-					sctp_m_getptr(m, auth_offset,
+				if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
+					auth = (struct sctp_auth_chunk *)
+						sctp_m_getptr(m, auth_offset,
 						      auth_len, chunk_buf);
-				got_auth = 1;
-				auth_skipped = 0;
+					got_auth = 1;
+					auth_skipped = 0;
+				} else {
+					auth = NULL;
+				}
 				if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
 								       auth_offset)) {
 					/* auth HMAC failed so dump it */

xpcom/io/nsStringStream.cpp

@@ -263,8 +263,23 @@ nsStringInputStream::ReadSegments(nsWriteSegmentFun aWriter, void* aClosure,
   if (aCount > maxCount) {
     aCount = maxCount;
   }
+
+  nsDependentCSubstring tempData;
+  tempData.SetIsVoid(true);
+  if (mData.Flags() & nsCSubstring::F_OWNED) {
+    tempData.Assign(std::move(mData));
+    mData.Rebind(tempData.BeginReading(), tempData.EndReading());
+  }
+
   nsresult rv = aWriter(this, aClosure, mData.BeginReading() + mOffset, 0,
                         aCount, aResult);
+
+  if (!mData.IsVoid() && !tempData.IsVoid()) {
+    MOZ_DIAGNOSTIC_ASSERT(mData == tempData, "String was replaced!");
+    mData.SetIsVoid(true);
+    mData.Assign(std::move(tempData));
+  }
+
   if (NS_SUCCEEDED(rv)) {
     NS_ASSERTION(*aResult <= aCount,
                  "writer should not write more than we asked it to write");