From 372bda2fcbba2a4528601b2bb64fc66f1de4db98 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tdz@users.sourceforge.net>
Date: Thu, 30 Apr 2015 11:29:25 +0200
Subject: [PATCH] Bug 1158818: Only store Bluetooth result runnable after
 command has been sent successfully, r=shuang

With the current code, the Bluetooth result runnable is saved for
receiving before a command has been sent successfully. If sending
fails afterwards, the saved result runnable will still sit in the
result queue, and interfere with later, successful commands.

With this patch, the result runnable is saved only if the sending
was successful.
---
 .../bluedroid/BluetoothDaemonInterface.cpp      |  1 +
 ipc/bluetooth/BluetoothDaemonConnection.cpp     | 17 ++++++++++++-----
 ipc/bluetooth/BluetoothDaemonConnection.h       |  7 +++++++
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp b/dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp
index 80664b43bc8..2ce93da8404 100644
--- a/dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothDaemonInterface.cpp
@@ -1507,6 +1507,7 @@ BluetoothDaemonProtocol::Send(BluetoothDaemonPDU* aPDU, void* aUserData)
   MOZ_ASSERT(mConnection);
   MOZ_ASSERT(aPDU);
 
+  aPDU->SetConsumer(this);
   aPDU->SetUserData(aUserData);
   aPDU->UpdateHeader();
   return mConnection->Send(aPDU); // Forward PDU to command channel
diff --git a/ipc/bluetooth/BluetoothDaemonConnection.cpp b/ipc/bluetooth/BluetoothDaemonConnection.cpp
index 8f6068f74b8..e474fd48a1d 100644
--- a/ipc/bluetooth/BluetoothDaemonConnection.cpp
+++ b/ipc/bluetooth/BluetoothDaemonConnection.cpp
@@ -42,8 +42,9 @@ static const char sBluetoothdSocketName[] = "bluez_hal_socket";
 
 BluetoothDaemonPDU::BluetoothDaemonPDU(uint8_t aService, uint8_t aOpcode,
                                        uint16_t aPayloadSize)
-: UnixSocketIOBuffer(HEADER_SIZE + aPayloadSize)
-, mUserData(nullptr)
+  : UnixSocketIOBuffer(HEADER_SIZE + aPayloadSize)
+  , mConsumer(nullptr)
+  , mUserData(nullptr)
 {
   uint8_t* data = Append(HEADER_SIZE);
   MOZ_ASSERT(data);
@@ -55,8 +56,9 @@ BluetoothDaemonPDU::BluetoothDaemonPDU(uint8_t aService, uint8_t aOpcode,
 }
 
 BluetoothDaemonPDU::BluetoothDaemonPDU(size_t aPayloadSize)
-: UnixSocketIOBuffer(HEADER_SIZE + aPayloadSize)
-, mUserData(nullptr)
+  : UnixSocketIOBuffer(HEADER_SIZE + aPayloadSize)
+  , mConsumer(nullptr)
+  , mUserData(nullptr)
 { }
 
 void
@@ -92,6 +94,12 @@ BluetoothDaemonPDU::Send(int aFd)
 
   Consume(res);
 
+  if (mConsumer) {
+    // We successfully sent a PDU, now store the
+    // result runnable in the consumer.
+    mConsumer->StoreUserData(*this);
+  }
+
   return res;
 }
 
@@ -376,7 +384,6 @@ BluetoothDaemonConnectionIO::Send(BluetoothDaemonPDU* aPDU)
   MOZ_ASSERT(mConsumer);
   MOZ_ASSERT(aPDU);
 
-  mConsumer->StoreUserData(*aPDU); // Store user data for reply
   EnqueueData(aPDU);
   AddWatchers(WRITE_WATCHER, false);
 }
diff --git a/ipc/bluetooth/BluetoothDaemonConnection.h b/ipc/bluetooth/BluetoothDaemonConnection.h
index 007c9acd69a..285e3234cb3 100644
--- a/ipc/bluetooth/BluetoothDaemonConnection.h
+++ b/ipc/bluetooth/BluetoothDaemonConnection.h
@@ -18,6 +18,7 @@ namespace mozilla {
 namespace ipc {
 
 class BluetoothDaemonConnectionIO;
+class BluetoothDaemonPDUConsumer;
 
 /*
  * |BlutoothDaemonPDU| represents a single PDU that is transfered from or to
@@ -55,6 +56,11 @@ public:
                      uint16_t aPayloadSize);
   BluetoothDaemonPDU(size_t aPayloadSize);
 
+  void SetConsumer(BluetoothDaemonPDUConsumer* aConsumer)
+  {
+    mConsumer = aConsumer;
+  }
+
   void SetUserData(void* aUserData)
   {
     mUserData = aUserData;
@@ -79,6 +85,7 @@ private:
   size_t GetPayloadSize() const;
   void OnError(const char* aFunction, int aErrno);
 
+  BluetoothDaemonPDUConsumer* mConsumer;
   void* mUserData;
   ScopedClose mReceivedFd;
 };