details: http://hg.nginx.org/nginx/rev/3ff29c30effb
branches:
changeset: 5510:3ff29c30effb
user: Valentin Bartenev <vbart@nginx.com>
date: Tue Jan 14 16:24:45 2014 +0400
description:
SPDY: elimination of r->blocked counter usage for queuing frames.

It was used to prevent destroying of request object when there are unsent
frames in queue for the stream. Since it was incremented for each frame
and is only 8 bits long, so it was not very hard to overflow the counter.

Now the stream->queued counter is checked instead.

diffstat:

src/http/ngx_http_spdy.c | 16 ++++++++++------
src/http/ngx_http_spdy_filter_module.c | 10 ----------
2 files changed, 10 insertions(+), 16 deletions(-)

diffs (95 lines):

diff -r 877a7bd72070 -r 3ff29c30effb src/http/ngx_http_spdy.c
--- a/src/http/ngx_http_spdy.c Tue Jan 14 16:24:45 2014 +0400
+++ b/src/http/ngx_http_spdy.c Tue Jan 14 16:24:45 2014 +0400
@@ -2642,9 +2642,16 @@ ngx_http_spdy_close_stream(ngx_http_spdy

sc = stream->connection;

- ngx_log_debug2(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
- "spdy close stream %ui, processing %ui",
- stream->id, sc->processing);
+ ngx_log_debug3(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
+ "spdy close stream %ui, queued %ui, processing %ui",
+ stream->id, stream->queued, sc->processing);
+
+ fc = stream->request->connection;
+
+ if (stream->queued) {
+ fc->write->handler = ngx_http_spdy_close_stream_handler;
+ return;
+ }

if (!stream->out_closed) {
if (ngx_http_spdy_send_rst_stream(sc, stream->id,
@@ -2685,8 +2692,6 @@ ngx_http_spdy_close_stream(ngx_http_spdy
index = &s->index;
}

- fc = stream->request->connection;
-
ngx_http_free_request(stream->request, rc);

ev = fc->read;
@@ -2862,7 +2867,6 @@ ngx_http_spdy_finalize_connection(ngx_ht
fc->error = 1;

if (stream->queued) {
- r->blocked -= stream->queued;
stream->queued = 0;

ev = fc->write;
diff -r 877a7bd72070 -r 3ff29c30effb src/http/ngx_http_spdy_filter_module.c
--- a/src/http/ngx_http_spdy_filter_module.c Tue Jan 14 16:24:45 2014 +0400
+++ b/src/http/ngx_http_spdy_filter_module.c Tue Jan 14 16:24:45 2014 +0400
@@ -597,8 +597,6 @@ ngx_http_spdy_header_filter(ngx_http_req

ngx_http_spdy_queue_blocked_frame(sc, frame);

- r->blocked++;
-
cln = ngx_http_cleanup_add(r, 0);
if (cln == NULL) {
return NGX_ERROR;
@@ -697,8 +695,6 @@ ngx_http_spdy_body_filter(ngx_http_reque

stream->queued++;

- r->main->blocked++;
-
return ngx_http_spdy_filter_send(r->connection, stream);
}

@@ -923,7 +919,6 @@ ngx_http_spdy_handle_frame(ngx_http_spdy
r = stream->request;

r->connection->sent += frame->size;
- r->blocked--;

if (frame->fin) {
stream->out_closed = 1;
@@ -962,15 +957,12 @@ ngx_http_spdy_filter_cleanup(void *data)
{
ngx_http_spdy_stream_t *stream = data;

- ngx_http_request_t *r;
ngx_http_spdy_out_frame_t *frame, **fn;

if (stream->queued == 0) {
return;
}

- r = stream->request;
-
fn = &stream->connection->last_out;

for ( ;; ) {
@@ -981,9 +973,7 @@ ngx_http_spdy_filter_cleanup(void *data)
}

if (frame->stream == stream && !frame->blocked) {
-
stream->queued--;
- r->blocked--;

*fn = frame->next;
continue;

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel