2011-03-26 Anders Carlsson <andersca@apple.com>

        Reviewed by Sam Weinig.

        Handle synchronous replies coming in out of order
        https://bugs.webkit.org/show_bug.cgi?id=57158

        When processing an incoming reply, don't assume that it belongs to the last sent synchronous request.
        Instead, iterate over the m_pendingSyncReplies vector backwards looking for the corresponding request.

        * Platform/CoreIPC/Connection.cpp:
        (CoreIPC::Connection::processIncomingMessage):


git-svn-id: svn://svn.chromium.org/blink/trunk@82035 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/WebKit2/ChangeLog

+2011-03-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Handle synchronous replies coming in out of order
+        https://bugs.webkit.org/show_bug.cgi?id=57158
+
+        When processing an incoming reply, don't assume that it belongs to the last sent synchronous request.
+        Instead, iterate over the m_pendingSyncReplies vector backwards looking for the corresponding request.
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::processIncomingMessage):
+
 2011-03-26  Anders Carlsson  <andersca@apple.com>
 
         Reviewed by Sam Weinig.

third_party/WebKit/Source/WebKit2/Platform/CoreIPC/Connection.cpp

@@ -405,12 +405,29 @@ void Connection::processIncomingMessage(MessageID messageID, PassOwnPtr<Argument
         MutexLocker locker(m_syncReplyStateMutex);
         ASSERT(!m_pendingSyncReplies.isEmpty());
 
-        PendingSyncReply& pendingSyncReply = m_pendingSyncReplies.last();
-        ASSERT(pendingSyncReply.syncRequestID == arguments->destinationID());
+        // Go through the stack of sync requests that have pending replies and see which one
+        // this reply is for.
+        for (size_t i = m_pendingSyncReplies.size(); i > 0; --i) {
+            PendingSyncReply& pendingSyncReply = m_pendingSyncReplies[i - 1];
 
-        pendingSyncReply.replyDecoder = arguments.leakPtr();
-        pendingSyncReply.didReceiveReply = true;
-        m_syncMessageState->wakeUpClientRunLoop();
+            if (pendingSyncReply.syncRequestID != arguments->destinationID())
+                continue;
+
+            ASSERT(!pendingSyncReply.replyDecoder);
+
+            pendingSyncReply.replyDecoder = arguments.leakPtr();
+            pendingSyncReply.didReceiveReply = true;
+
+            // We got a reply to the last send message, wake up the client run loop so it can be processed.
+            if (i == m_pendingSyncReplies.size())
+                m_syncMessageState->wakeUpClientRunLoop();
+
+            return;
+        }
+
+        // We got a reply for a message we never sent.
+        // FIXME: Dispatch a didReceiveInvalidMessage callback on the client.
+        ASSERT_NOT_REACHED();
         return;
     }