Bug 1462912 - Fixed BufferList::Extract to handle the case where the call consumes the entirety of the BufferList. r=froydnj, a=RyanVM

2 files changed, 20 insertions, 1 deletions

diff --git a/mfbt/BufferList.h b/mfbt/BufferList.h
index aaff31454d..7faf5a2aee 100644
--- a/mfbt/BufferList.h
+++ b/mfbt/BufferList.h
@@ -532,7 +532,14 @@ BufferList<AllocPolicy>::Extract(IterImpl& aIter, size_t aSize, bool* aSuccess)
                 mSegments[aIter.mSegment].mCapacity));
       aIter.Advance(*this, aIter.RemainingInSegment());
     }
-    MOZ_RELEASE_ASSERT(aIter.mSegment == copyStart + segmentsToCopy);
+    // Due to the way IterImpl works, there are two cases here: (1) if we've
+    // consumed the entirety of the BufferList, then the iterator is pointed at
+    // the end of the final segment, (2) otherwise it is pointed at the start
+    // of the next segment. We want to verify that we really consumed all
+    // |segmentsToCopy| segments.
+    MOZ_RELEASE_ASSERT(
+      (aIter.mSegment == copyStart + segmentsToCopy) ||
+      (aIter.Done() && aIter.mSegment == copyStart + segmentsToCopy - 1));
     mSegments.erase(mSegments.begin() + copyStart,
                     mSegments.begin() + copyStart + segmentsToCopy);
 
diff --git a/mfbt/tests/TestBufferList.cpp b/mfbt/tests/TestBufferList.cpp
index 207fa106f5..325f8a3aa7 100644
--- a/mfbt/tests/TestBufferList.cpp
+++ b/mfbt/tests/TestBufferList.cpp
@@ -279,5 +279,17 @@ int main(void)
   MOZ_RELEASE_ASSERT(bl9.Size() == 8);
   MOZ_RELEASE_ASSERT(!iter.Done());
 
+  BufferList bl10(0, 0, 8);
+  bl10.WriteBytes("abcdefgh", 8);
+  bl10.WriteBytes("12345678", 8);
+  iter = bl10.Iter();
+  BufferList bl11 = bl10.Extract(iter, 16, &success);
+  MOZ_RELEASE_ASSERT(success);
+  MOZ_RELEASE_ASSERT(bl11.Size() == 16);
+  MOZ_RELEASE_ASSERT(iter.Done());
+  iter = bl11.Iter();
+  MOZ_RELEASE_ASSERT(bl11.ReadBytes(iter, data, 16));
+  MOZ_RELEASE_ASSERT(memcmp(data, "abcdefgh12345678", 16) == 0);
+
   return 0;
 }