joyent/node — pull request #6593 by indutny (2013-11-27 10:58:57+00:00)
Title: http: fix parser double-free in _http_client.js

HTTP Parser instance was freed twice, leading to the reusal of it
in several different requests simultaneously. After adding some
debugging code, following stack traces were found:

Double freed parser
Trace
at exports.FreeList.free (freelist.js:45:9)
at freeParser (_http_common.js:202:13)
at TLSSocket.socketCloseListener (_http_client.js:223:5)
at TLSSocket.EventEmitter.emit (events.js:120:20)
at TCP.close (net.js:459:12)
Previously freed at
Error
at exports.FreeList.free (freelist.js:50:18)
at freeParser (_http_common.js:202:13)
at TLSSocket.socketOnData (_http_client.js:318:5)
at TLSSocket.EventEmitter.emit (events.js:98:17)
at TLSSocket.Readable.read (_stream_readable.js:366:10)
at TLSSocket.socketCloseListener (_http_client.js:194:10)
at TLSSocket.EventEmitter.emit (events.js:120:20)
at TCP.close (net.js:459:12)

The problem is that `socketCloseListener` is calling `socket.read()` to
ensure that all data is received by the `socketOnData` listener, but
since `socketCloseListener` gets `socket.parser` before calling
`socket.read()`, it can't see that the parser is already freed by
`socketOnData`.

fix #6451

/cc @bnoordhuis @isaacs @tjfontaine