Revert "Fix the case where the browser livelocks if we cannot open a file."

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@40291 0039d316-1c4b-4281-b951-d872f2087c98

17 files changed, 69 insertions, 589 deletions

diff --git a/net/base/file_stream.h b/net/base/file_stream.h
index def87bc..6b7f3dc 100644
--- a/net/base/file_stream.h
+++ b/net/base/file_stream.h
@@ -43,24 +43,13 @@ class FileStream {
   // Note that if there are any pending async operations, they'll be aborted.
   void Close();
 
-  // Release performs the same actions as Close, but doesn't actually close the
-  // underlying PlatformFile.
-  void Release();
-
   // Call this method to open the FileStream.  The remaining methods
   // cannot be used unless this method returns OK.  If the file cannot be
   // opened then an error code is returned.
   // open_flags is a bitfield of base::PlatformFileFlags
   int Open(const FilePath& path, int open_flags);
 
-  // Calling this method is functionally the same as constructing the object
-  // with the non-default constructor. This method can only be used if the
-  // FileSteam isn't currently open (i.e. was constructed with the default
-  // constructor).
-  int Open(base::PlatformFile file, int open_flags);
-
-  // Returns true if Open succeeded and neither Close nor Release have been
-  // called.
+  // Returns true if Open succeeded and Close has not been called.
   bool IsOpen() const;
 
   // Adjust the position from where data is read.  Upon success, the stream
diff --git a/net/base/file_stream_posix.cc b/net/base/file_stream_posix.cc
index e947a6e..a4c5b3c 100644
--- a/net/base/file_stream_posix.cc
+++ b/net/base/file_stream_posix.cc
@@ -298,8 +298,13 @@ FileStream::FileStream()
 }
 
 FileStream::FileStream(base::PlatformFile file, int flags)
-    : file_(base::kInvalidPlatformFileValue) {
-  Open(file, flags);
+    : file_(file),
+      open_flags_(flags) {
+  // If the file handle is opened with base::PLATFORM_FILE_ASYNC, we need to
+  // make sure we will perform asynchronous File IO to it.
+  if (flags & base::PLATFORM_FILE_ASYNC) {
+    async_context_.reset(new AsyncContext());
+  }
 }
 
 FileStream::~FileStream() {
@@ -318,12 +323,6 @@ void FileStream::Close() {
   }
 }
 
-void FileStream::Release() {
-  // Abort any existing asynchronous operations.
-  async_context_.reset();
-  file_ = base::kInvalidPlatformFileValue;
-}
-
 int FileStream::Open(const FilePath& path, int open_flags) {
   if (IsOpen()) {
     DLOG(FATAL) << "File is already open!";
@@ -345,21 +344,6 @@ int FileStream::Open(const FilePath& path, int open_flags) {
   return OK;
 }
 
-int FileStream::Open(base::PlatformFile file, int open_flags) {
-  if (IsOpen()) {
-    DLOG(FATAL) << "File is already open!";
-    return ERR_UNEXPECTED;
-  }
-
-  open_flags_ = open_flags;
-  file_ = file;
-
-  if (open_flags & base::PLATFORM_FILE_ASYNC)
-    async_context_.reset(new AsyncContext());
-
-  return OK;
-}
-
 bool FileStream::IsOpen() const {
   return file_ != base::kInvalidPlatformFileValue;
 }
@@ -461,7 +445,7 @@ int64 FileStream::Truncate(int64 bytes) {
   if (!IsOpen())
     return ERR_UNEXPECTED;
 
-  // We better be open for writing.
+  // We better be open for reading.
   DCHECK(open_flags_ & base::PLATFORM_FILE_WRITE);
 
   // Seek to the position to truncate from.
diff --git a/net/base/file_stream_win.cc b/net/base/file_stream_win.cc
index e1928a7..cec6a9d 100644
--- a/net/base/file_stream_win.cc
+++ b/net/base/file_stream_win.cc
@@ -120,10 +120,16 @@ FileStream::FileStream()
       open_flags_(0) {
 }
 
-FileStream::FileStream(base::PlatformFile file, int open_flags)
-    : file_(INVALID_HANDLE_VALUE),
-      open_flags_(0) {
-  Open(file, open_flags);
+FileStream::FileStream(base::PlatformFile file, int flags)
+    : file_(file),
+      open_flags_(flags) {
+  // If the file handle is opened with base::PLATFORM_FILE_ASYNC, we need to
+  // make sure we will perform asynchronous File IO to it.
+  if (flags & base::PLATFORM_FILE_ASYNC) {
+    async_context_.reset(new AsyncContext(this));
+    MessageLoopForIO::current()->RegisterIOHandler(file_,
+                                                   async_context_.get());
+  }
 }
 
 FileStream::~FileStream() {
@@ -141,13 +147,6 @@ void FileStream::Close() {
   }
 }
 
-void FileStream::Release() {
-  if (file_ != INVALID_HANDLE_VALUE)
-    CancelIo(file_);
-  async_context_.reset();
-  file_ = INVALID_HANDLE_VALUE;
-}
-
 int FileStream::Open(const FilePath& path, int open_flags) {
   if (IsOpen()) {
     DLOG(FATAL) << "File is already open!";
@@ -171,26 +170,6 @@ int FileStream::Open(const FilePath& path, int open_flags) {
   return OK;
 }
 
-int FileStream::Open(base::PlatformFile file, int open_flags) {
-  if (IsOpen()) {
-    DLOG(FATAL) << "File is already open!";
-    return ERR_UNEXPECTED;
-  }
-
-  open_flags_ = open_flags;
-  file_ = file;
-
-  // If the file handle is opened with base::PLATFORM_FILE_ASYNC, we need to
-  // make sure we will perform asynchronous File IO to it.
-  if (open_flags_ & base::PLATFORM_FILE_ASYNC) {
-    async_context_.reset(new AsyncContext(this));
-    MessageLoopForIO::current()->RegisterIOHandler(file_,
-                                                   async_context_.get());
-  }
-
-  return OK;
-}
-
 bool FileStream::IsOpen() const {
   return file_ != INVALID_HANDLE_VALUE;
 }
diff --git a/net/base/upload_data.cc b/net/base/upload_data.cc
index a23b25e..0496873 100644
--- a/net/base/upload_data.cc
+++ b/net/base/upload_data.cc
@@ -5,7 +5,6 @@
 #include "net/base/upload_data.h"
 
 #include "base/file_util.h"
-#include "base/platform_file.h"
 #include "base/logging.h"
 
 namespace net {
@@ -18,67 +17,28 @@ uint64 UploadData::GetContentLength() const {
   return len;
 }
 
-void UploadData::CloseFiles() {
-  std::vector<Element>::iterator it = elements_.begin();
-  for (; it != elements_.end(); ++it) {
-    if (it->type() == TYPE_FILE)
-      it->Close();
-  }
-}
-
-base::PlatformFile UploadData::Element::platform_file() const {
-  DCHECK(type_ == TYPE_FILE) << "platform_file on non-file Element";
-
-  return file_;
-}
-
-void UploadData::Element::Close() {
-  DCHECK(type_ == TYPE_FILE) << "Close on non-file Element";
-
-  if (file_ != base::kInvalidPlatformFileValue)
-    base::ClosePlatformFile(file_);
-  file_ = base::kInvalidPlatformFileValue;
-}
-
-void UploadData::Element::SetToFilePathRange(const FilePath& path,
-                                             uint64 offset,
-                                             uint64 length) {
-  type_ = TYPE_FILE;
-  file_range_offset_ = 0;
-  file_range_length_ = 0;
+uint64 UploadData::Element::GetContentLength() const {
+  if (override_content_length_)
+    return content_length_;
 
-  Close();
+  if (type_ == TYPE_BYTES)
+    return static_cast<uint64>(bytes_.size());
 
-  if (offset + length < offset) {
-    LOG(ERROR) << "Upload file offset and length overflow 64-bits. Ignoring.";
-    return;
-  }
+  DCHECK(type_ == TYPE_FILE);
 
-  base::PlatformFile file = base::CreatePlatformFile(
-      path, base::PLATFORM_FILE_OPEN | base::PLATFORM_FILE_READ, NULL);
-  if (file == base::kInvalidPlatformFileValue) {
-    // This case occurs when the user selects a file that isn't readable.
-    file_path_= path;
-    return;
-  }
+  // TODO(darin): This size calculation could be out of sync with the state of
+  // the file when we get around to reading it.  We should probably find a way
+  // to lock the file or somehow protect against this error condition.
 
-  uint64 file_size;
-  if (!base::GetPlatformFileSize(file, &file_size)) {
-    base::ClosePlatformFile(file);
-    return;
-  }
+  int64 length = 0;
+  if (!file_util::GetFileSize(file_path_, &length))
+    return 0;
 
-  if (offset > file_size) {
-    base::ClosePlatformFile(file);
-    return;
-  }
-  if (offset + length > file_size)
-    length = file_size - offset;
+  if (file_range_offset_ >= static_cast<uint64>(length))
+    return 0;  // range is beyond eof
 
-  file_ = file;
-  file_path_ = path;
-  file_range_offset_ = offset;
-  file_range_length_ = length;
+  // compensate for the offset and clip file_range_length_ to eof
+  return std::min(length - file_range_offset_, file_range_length_);
 }
 
 }  // namespace net
diff --git a/net/base/upload_data.h b/net/base/upload_data.h
index d01b435..3aab835 100644
--- a/net/base/upload_data.h
+++ b/net/base/upload_data.h
@@ -9,7 +9,6 @@
 
 #include "base/basictypes.h"
 #include "base/file_path.h"
-#include "base/platform_file.h"
 #include "base/ref_counted.h"
 #include "testing/gtest/include/gtest/gtest_prod.h"
 
@@ -27,8 +26,7 @@ class UploadData : public base::RefCounted<UploadData> {
   class Element {
    public:
     Element() : type_(TYPE_BYTES), file_range_offset_(0),
-                file_range_length_(0),
-                file_(base::kInvalidPlatformFileValue),
+                file_range_length_(kuint64max),
                 override_content_length_(false) {
     }
 
@@ -47,42 +45,19 @@ class UploadData : public base::RefCounted<UploadData> {
       SetToFilePathRange(path, 0, kuint64max);
     }
 
-    void SetToFilePathRange(const FilePath& path, uint64 offset, uint64 length);
+    void SetToFilePathRange(const FilePath& path,
+                            uint64 offset, uint64 length) {
+      type_ = TYPE_FILE;
+      file_path_ = path;
+      file_range_offset_ = offset;
+      file_range_length_ = length;
+    }
 
     // Returns the byte-length of the element.  For files that do not exist, 0
     // is returned.  This is done for consistency with Mozilla.
-    uint64 GetContentLength() const {
-      if (override_content_length_)
-        return content_length_;
-
-      if (type_ == TYPE_BYTES) {
-        return bytes_.size();
-      } else {
-        return file_range_length_;
-      }
-    }
-
-    // For a TYPE_FILE, return a handle to the file. The caller does not take
-    // ownership and should not close the file handle.
-    base::PlatformFile platform_file() const;
-
-    // For a TYPE_FILE, this closes the file handle. It's a fatal error to call
-    // platform_file() after this.
-    void Close();
+    uint64 GetContentLength() const;
 
    private:
-    // type_ == TYPE_BYTES:
-    //   bytes_ is valid
-    // type_ == TYPE_FILE:
-    //   file_path_ should always be valid.
-    //
-    //   platform_file() may be invalid, in which case file_range_* are 0 and
-    //   file_ is invalid. This occurs when we cannot open the requested file.
-    //
-    //   Else, then file_range_* are within range of the length of the file
-    //   that we found when opening the file. Also, the sum of offset and
-    //   length will not overflow a uint64. file_ will be handle to the file.
-
     // Allows tests to override the result of GetContentLength.
     void SetContentLength(uint64 content_length) {
       override_content_length_ = true;
@@ -94,7 +69,6 @@ class UploadData : public base::RefCounted<UploadData> {
     FilePath file_path_;
     uint64 file_range_offset_;
     uint64 file_range_length_;
-    base::PlatformFile file_;
     bool override_content_length_;
     uint64 content_length_;
 
@@ -135,9 +109,6 @@ class UploadData : public base::RefCounted<UploadData> {
     elements_.swap(*elements);
   }
 
-  // CloseFiles closes the file handles of all Elements of type TYPE_FILE.
-  void CloseFiles();
-
   // Identifies a particular upload instance, which is used by the cache to
   // formulate a cache key.  This value should be unique across browser
   // sessions.  A value of 0 is used to indicate an unspecified identifier.
diff --git a/net/base/upload_data_stream.cc b/net/base/upload_data_stream.cc
index 9fca29e..221ef28 100644
--- a/net/base/upload_data_stream.cc
+++ b/net/base/upload_data_stream.cc
@@ -10,7 +10,7 @@
 
 namespace net {
 
-UploadDataStream::UploadDataStream(UploadData* data)
+UploadDataStream::UploadDataStream(const UploadData* data)
     : data_(data),
       buf_(new IOBuffer(kBufSize)),
       buf_len_(0),
@@ -67,19 +67,18 @@ void UploadDataStream::FillBuf() {
     } else {
       DCHECK(element.type() == UploadData::TYPE_FILE);
 
-      if (element.file_range_length() == 0) {
-        // If we failed to open the file, then the length is set to zero. The
-        // length used when calculating the POST size was also zero. This
-        // matches the behaviour of Mozilla.
-        next_element_remaining_ = 0;
-      } else {
-        if (!next_element_stream_.IsOpen()) {
-          // We ignore the return value of Open becuase we've already checked
-          // !IsOpen, above.
-          int flags = base::PLATFORM_FILE_READ |
-                      base::PLATFORM_FILE_WRITE;
-          next_element_stream_.Open(element.platform_file(), flags);
-
+      if (!next_element_stream_.IsOpen()) {
+        int flags = base::PLATFORM_FILE_OPEN |
+                    base::PLATFORM_FILE_READ;
+        int rv = next_element_stream_.Open(element.file_path(), flags);
+        // If the file does not exist, that's technically okay.. we'll just
+        // upload an empty file.  This is for consistency with Mozilla.
+        DLOG_IF(WARNING, rv != OK) << "Failed to open \""
+                                   << element.file_path().value()
+                                   << "\" for reading: " << rv;
+
+        next_element_remaining_ = 0;  // Default to reading nothing.
+        if (rv == OK) {
           uint64 offset = element.file_range_offset();
           if (offset && next_element_stream_.Seek(FROM_BEGIN, offset) < 0) {
             DLOG(WARNING) << "Failed to seek \"" << element.file_path().value()
@@ -91,18 +90,11 @@ void UploadDataStream::FillBuf() {
       }
 
       int rv = 0;
-      if (next_element_remaining_ > 0) {
-        int count =
-            static_cast<int>(std::min(next_element_remaining_,
-                                      static_cast<uint64>(size_remaining)));
-        rv = next_element_stream_.Read(buf_->data() + buf_len_, count, NULL);
-        if (rv < 1) {
-          // If the file was truncated between the time that we opened it and
-          // now, or if we got an error on reading, then we pad with NULs.
-          memset(buf_->data() + buf_len_, 0, count);
-          rv = count;
-        }
-
+      int count = static_cast<int>(std::min(
+          static_cast<uint64>(size_remaining), next_element_remaining_));
+      if (count > 0 &&
+          (rv = next_element_stream_.Read(buf_->data() + buf_len_,
+                                          count, NULL)) > 0) {
         buf_len_ += rv;
         next_element_remaining_ -= rv;
       } else {
@@ -113,14 +105,12 @@ void UploadDataStream::FillBuf() {
     if (advance_to_next_element) {
       ++next_element_;
       next_element_offset_ = 0;
-      next_element_stream_.Release();
+      next_element_stream_.Close();
     }
   }
 
-  if (next_element_ == end && !buf_len_) {
+  if (next_element_ == end && !buf_len_)
     eof_ = true;
-    data_->CloseFiles();
-  }
 }
 
 }  // namespace net
diff --git a/net/base/upload_data_stream.h b/net/base/upload_data_stream.h
index 9df5db0..0dd7dd3 100644
--- a/net/base/upload_data_stream.h
+++ b/net/base/upload_data_stream.h
@@ -14,7 +14,7 @@ class IOBuffer;
 
 class UploadDataStream {
  public:
-  explicit UploadDataStream(UploadData* data);
+  explicit UploadDataStream(const UploadData* data);
   ~UploadDataStream();
 
   // Returns the stream's buffer and buffer length.
@@ -42,7 +42,7 @@ class UploadDataStream {
   // left to fill the buffer with.
   void FillBuf();
 
-  UploadData* data_;
+  const UploadData* data_;
 
   // This buffer is filled with data to be uploaded.  The data to be sent is
   // always at the front of the buffer.  If we cannot send all of the buffer at
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index 60af134..42dd74f 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -380,12 +380,6 @@ int SSLClientSocketNSS::InitializeSSLOptions() {
      LOG(INFO) << "SSL_ENABLE_DEFLATE failed.  Old system nss?";
 #endif
 
-#ifdef SSL_ENABLE_FALSE_START
-  rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_FALSE_START, PR_TRUE);
-  if (rv != SECSuccess)
-     LOG(INFO) << "SSL_ENABLE_FALSE_START failed.  Old system nss?";
-#endif
-
 #ifdef SSL_ENABLE_RENEGOTIATION
   // We allow servers to request renegotiation. Since we're a client,
   // prohibiting this is rather a waste of time. Only servers are in a position
diff --git a/net/third_party/nss/README.google b/net/third_party/nss/README.google
index 291e176..ce46e1a 100644
--- a/net/third_party/nss/README.google
+++ b/net/third_party/nss/README.google
@@ -9,9 +9,6 @@ Patches:
     patches/nextproto.patch
     http://codereview.chromium.org/415005
 
-  * False start support
-    patches/falsestart.patch
-
   * Commenting out a couple of functions because they need NSS symbols
     which may not exist in the system NSS library.
     patches/versionskew.patch
diff --git a/net/third_party/nss/nss.gyp b/net/third_party/nss/nss.gyp
index 1e7ef49..5511066 100644
--- a/net/third_party/nss/nss.gyp
+++ b/net/third_party/nss/nss.gyp
@@ -126,13 +126,6 @@
           },
         }],
       ],
-      'configurations': {
-        'Debug_Base': {
-          'defines': [
-            'DEBUG',
-          ],
-        },
-      },
     },
   ],
 }
diff --git a/net/third_party/nss/patches/falsestart.patch b/net/third_party/nss/patches/falsestart.patch
deleted file mode 100644
index ad41b20e..0000000
--- a/net/third_party/nss/patches/falsestart.patch
+++ /dev/null
@@ -1,319 +0,0 @@
-diff --git a/mozilla/security/nss/cmd/strsclnt/strsclnt.c b/mozilla/security/nss/cmd/strsclnt/strsclnt.c
-index c266644..1f71434 100644
---- a/mozilla/security/nss/cmd/strsclnt/strsclnt.c
-+++ b/mozilla/security/nss/cmd/strsclnt/strsclnt.c
-@@ -162,6 +162,7 @@ static PRBool disableLocking  = PR_FALSE;
- static PRBool ignoreErrors    = PR_FALSE;
- static PRBool enableSessionTickets = PR_FALSE;
- static PRBool enableCompression    = PR_FALSE;
-+static PRBool enableFalseStart     = PR_FALSE;
- 
- PRIntervalTime maxInterval    = PR_INTERVAL_NO_TIMEOUT;
- 
-@@ -197,7 +198,8 @@ Usage(const char *progName)
-         "       -U means enable throttling up threads\n"
- 	"       -B bypasses the PKCS11 layer for SSL encryption and MACing\n"
- 	"       -u enable TLS Session Ticket extension\n"
--	"       -z enable compression\n",
-+	"       -z enable compression\n"
-+	"       -g enable false start\n",
- 	progName);
-     exit(1);
- }
-@@ -1244,6 +1246,12 @@ client_main(
- 	    errExit("SSL_OptionSet SSL_ENABLE_DEFLATE");
-     }
- 
-+    if (enableFalseStart) {
-+	rv = SSL_OptionSet(model_sock, SSL_ENABLE_FALSE_START, PR_TRUE);
-+	if (rv != SECSuccess)
-+	    errExit("SSL_OptionSet SSL_ENABLE_FALSE_START");
-+    }
-+
-     SSL_SetURL(model_sock, hostName);
- 
-     SSL_AuthCertificateHook(model_sock, mySSLAuthCertificate, 
-@@ -1354,7 +1362,7 @@ main(int argc, char **argv)
-  
- 
-     optstate = PL_CreateOptState(argc, argv,
--                                 "23BC:DNP:TUW:a:c:d:f:in:op:qst:uvw:z");
-+                                 "23BC:DNP:TUW:a:c:d:f:gin:op:qst:uvw:z");
-     while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
- 	switch(optstate->option) {
- 
-@@ -1384,6 +1392,8 @@ main(int argc, char **argv)
- 
- 	case 'f': fileName = optstate->value; break;
- 
-+	case 'g': enableFalseStart = PR_TRUE; break;
-+
- 	case 'i': ignoreErrors = PR_TRUE; break;
- 
-         case 'n': nickName = PL_strdup(optstate->value); break;
-diff --git a/mozilla/security/nss/cmd/tstclnt/tstclnt.c b/mozilla/security/nss/cmd/tstclnt/tstclnt.c
-index c15a0ad..55684e6 100644
---- a/mozilla/security/nss/cmd/tstclnt/tstclnt.c
-+++ b/mozilla/security/nss/cmd/tstclnt/tstclnt.c
-@@ -225,6 +225,7 @@ static void Usage(const char *progName)
-     fprintf(stderr, "%-20s Renegotiate N times (resuming session if N>1).\n", "-r N");
-     fprintf(stderr, "%-20s Enable the session ticket extension.\n", "-u");
-     fprintf(stderr, "%-20s Enable compression.\n", "-z");
-+    fprintf(stderr, "%-20s Enable false start.\n", "-g");
-     fprintf(stderr, "%-20s Letter(s) chosen from the following list\n", 
-                     "-c ciphers");
-     fprintf(stderr, 
-@@ -521,6 +522,7 @@ int main(int argc, char **argv)
-     int                useExportPolicy = 0;
-     int                enableSessionTickets = 0;
-     int                enableCompression = 0;
-+    int                enableFalseStart = 0;
-     PRSocketOptionData opt;
-     PRNetAddr          addr;
-     PRPollDesc         pollset[2];
-@@ -551,7 +553,7 @@ int main(int argc, char **argv)
-     }
- 
-     optstate = PL_CreateOptState(argc, argv,
--                                 "23BSTW:a:c:d:fh:m:n:op:qr:suvw:xz");
-+                                 "23BSTW:a:c:d:fgh:m:n:op:qr:suvw:xz");
-     while ((optstatus = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
- 	switch (optstate->option) {
- 	  case '?':
-@@ -578,6 +580,8 @@ int main(int argc, char **argv)
- 
-           case 'c': cipherString = PORT_Strdup(optstate->value); break;
- 
-+          case 'g': enableFalseStart = 1; 		break;
-+
-           case 'd': certDir = PORT_Strdup(optstate->value);   break;
- 
-           case 'f': clientSpeaksFirst = PR_TRUE;        break;
-@@ -863,7 +867,14 @@ int main(int argc, char **argv)
- 	SECU_PrintError(progName, "error enabling compression");
- 	return 1;
-     }
--               
-+
-+    /* enable false start. */
-+    rv = SSL_OptionSet(s, SSL_ENABLE_FALSE_START, enableFalseStart);
-+    if (rv != SECSuccess) {
-+	SECU_PrintError(progName, "error enabling false start");
-+	return 1;
-+    }
-+
-     SSL_SetPKCS11PinArg(s, &pwdata);
- 
-     SSL_AuthCertificateHook(s, SSL_AuthCertificate, (void *)handle);
-diff --git a/mozilla/security/nss/lib/ssl/ssl.h b/mozilla/security/nss/lib/ssl/ssl.h
-index e285ab4..bd1bfd3 100644
---- a/mozilla/security/nss/lib/ssl/ssl.h
-+++ b/mozilla/security/nss/lib/ssl/ssl.h
-@@ -128,6 +128,17 @@ SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd);
-                                           /* Renegotiation  Info (RI)       */
- 					  /* extension in ALL handshakes.   */
-                                           /* default: off                   */
-+#define SSL_ENABLE_FALSE_START	       22 /* Enable SSL false start (off by */
-+					  /* default, applies only to       */
-+					  /* clients). False start is a     */
-+/* mode where an SSL client will start sending application data before      */
-+/* verifying the server's Finished message. This means that we could end up */
-+/* sending data to an imposter. However, the data will be encrypted and     */
-+/* only the true server can derive the session key. Thus, so long as the    */
-+/* cipher isn't broken this is safe. Because of this, False Start will only */
-+/* occur on RSA or DH ciphersuites where the cipher's key length is >= 80   */
-+/* bits. The advantage of False Start is that it saves a round trip for     */
-+/* client-speaks-first protocols when performing a full handshake.          */
- 
- #ifdef SSL_DEPRECATED_FUNCTION 
- /* Old deprecated function names */
-diff --git a/mozilla/security/nss/lib/ssl/ssl3con.c b/mozilla/security/nss/lib/ssl/ssl3con.c
-index 6b37c4f..f073431 100644
---- a/mozilla/security/nss/lib/ssl/ssl3con.c
-+++ b/mozilla/security/nss/lib/ssl/ssl3con.c
-@@ -5656,7 +5656,17 @@ ssl3_RestartHandshakeAfterCertReq(sslSocket *         ss,
-     return rv;
- }
- 
--
-+PRBool
-+ssl3_CanFalseStart(sslSocket *ss) {
-+    return ss->opt.enableFalseStart &&
-+	   !ss->sec.isServer &&
-+	   !ss->ssl3.hs.isResuming &&
-+	   ss->ssl3.cwSpec &&
-+	   ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
-+	   (ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_rsa ||
-+	    ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_dh  ||
-+	    ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_ecdh);
-+}
- 
- /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
-  * ssl3 Server Hello Done message.
-@@ -5728,6 +5738,12 @@ ssl3_HandleServerHelloDone(sslSocket *ss)
- 	ss->ssl3.hs.ws = wait_new_session_ticket;
-     else
- 	ss->ssl3.hs.ws = wait_change_cipher;
-+
-+    /* Do the handshake callback for sslv3 here. */
-+    if (ss->handshakeCallback != NULL && ssl3_CanFalseStart(ss)) {
-+	(ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
-+    }
-+
-     return SECSuccess;
- 
- loser:
-@@ -8468,7 +8484,7 @@ xmit_loser:
-     ss->ssl3.hs.ws = idle_handshake;
- 
-     /* Do the handshake callback for sslv3 here. */
--    if (ss->handshakeCallback != NULL) {
-+    if (ss->handshakeCallback != NULL && !ssl3_CanFalseStart(ss)) {
- 	(ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
-     }
- 
-diff --git a/mozilla/security/nss/lib/ssl/ssl3gthr.c b/mozilla/security/nss/lib/ssl/ssl3gthr.c
-index bdd2958..28fe154 100644
---- a/mozilla/security/nss/lib/ssl/ssl3gthr.c
-+++ b/mozilla/security/nss/lib/ssl/ssl3gthr.c
-@@ -188,6 +188,7 @@ ssl3_GatherCompleteHandshake(sslSocket *ss, int flags)
- {
-     SSL3Ciphertext cText;
-     int            rv;
-+    PRBool         canFalseStart = PR_FALSE;
- 
-     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
-     do {
-@@ -207,7 +208,17 @@ ssl3_GatherCompleteHandshake(sslSocket *ss, int flags)
- 	if (rv < 0) {
- 	    return ss->recvdCloseNotify ? 0 : rv;
- 	}
--    } while (ss->ssl3.hs.ws != idle_handshake && ss->gs.buf.len == 0);
-+
-+	if (ss->opt.enableFalseStart) {
-+	    ssl_GetSSL3HandshakeLock(ss);
-+	    canFalseStart = (ss->ssl3.hs.ws == wait_change_cipher ||
-+			     ss->ssl3.hs.ws == wait_new_session_ticket) &&
-+		            ssl3_CanFalseStart(ss);
-+	    ssl_ReleaseSSL3HandshakeLock(ss);
-+	}
-+    } while (ss->ssl3.hs.ws != idle_handshake &&
-+             !canFalseStart &&
-+             ss->gs.buf.len == 0);
- 
-     ss->gs.readOffset = 0;
-     ss->gs.writeOffset = ss->gs.buf.len;
-diff --git a/mozilla/security/nss/lib/ssl/sslimpl.h b/mozilla/security/nss/lib/ssl/sslimpl.h
-index 7581b98..00f0ce2 100644
---- a/mozilla/security/nss/lib/ssl/sslimpl.h
-+++ b/mozilla/security/nss/lib/ssl/sslimpl.h
-@@ -333,6 +333,7 @@ typedef struct sslOptionsStr {
-     unsigned int enableDeflate          : 1;  /* 19 */
-     unsigned int enableRenegotiation    : 2;  /* 20-21 */
-     unsigned int requireSafeNegotiation : 1;  /* 22 */
-+    unsigned int enableFalseStart       : 1;  /* 23 */
- } sslOptions;
- 
- typedef enum { sslHandshakingUndetermined = 0,
-@@ -1250,6 +1251,8 @@ extern void      ssl_SetAlwaysBlock(sslSocket *ss);
- 
- extern SECStatus ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled);
- 
-+extern PRBool    ssl3_CanFalseStart(sslSocket *ss);
-+
- #define SSL_LOCK_READER(ss)		if (ss->recvLock) PZ_Lock(ss->recvLock)
- #define SSL_UNLOCK_READER(ss)		if (ss->recvLock) PZ_Unlock(ss->recvLock)
- #define SSL_LOCK_WRITER(ss)		if (ss->sendLock) PZ_Lock(ss->sendLock)
-diff --git a/mozilla/security/nss/lib/ssl/sslsecur.c b/mozilla/security/nss/lib/ssl/sslsecur.c
-index 8f79135..4dc0475 100644
---- a/mozilla/security/nss/lib/ssl/sslsecur.c
-+++ b/mozilla/security/nss/lib/ssl/sslsecur.c
-@@ -148,6 +148,12 @@ ssl_Do1stHandshake(sslSocket *ss)
- 	    ss->gs.readOffset  = 0;
- 	    break;
- 	}
-+	if (ss->version >= SSL_LIBRARY_VERSION_3_0 &&
-+	    (ss->ssl3.hs.ws == wait_change_cipher ||
-+	     ss->ssl3.hs.ws == wait_new_session_ticket) &&
-+	    ssl3_CanFalseStart(ss)) {
-+	    break;
-+	}
- 	rv = (*ss->handshake)(ss);
- 	++loopCount;
-     /* This code must continue to loop on SECWouldBlock, 
-diff --git a/mozilla/security/nss/lib/ssl/sslsock.c b/mozilla/security/nss/lib/ssl/sslsock.c
-index aab48d6..40f633a 100644
---- a/mozilla/security/nss/lib/ssl/sslsock.c
-+++ b/mozilla/security/nss/lib/ssl/sslsock.c
-@@ -183,6 +183,7 @@ static sslOptions ssl_defaults = {
-     PR_FALSE,   /* enableDeflate      */
-     2,          /* enableRenegotiation (default: requires extension) */
-     PR_FALSE,   /* requireSafeNegotiation */
-+    PR_FALSE,   /* enableFalseStart   */
- };
- 
- sslSessionIDLookupFunc  ssl_sid_lookup;
-@@ -728,6 +729,10 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 which, PRBool on)
- 	ss->opt.requireSafeNegotiation = on;
- 	break;
- 
-+      case SSL_ENABLE_FALSE_START:
-+	ss->opt.enableFalseStart = on;
-+	break;
-+
-       default:
- 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
- 	rv = SECFailure;
-@@ -791,6 +796,7 @@ SSL_OptionGet(PRFileDesc *fd, PRInt32 which, PRBool *pOn)
-                                   on = ss->opt.enableRenegotiation; break;
-     case SSL_REQUIRE_SAFE_NEGOTIATION: 
-                                   on = ss->opt.requireSafeNegotiation; break;
-+    case SSL_ENABLE_FALSE_START:  on = ss->opt.enableFalseStart;   break;
- 
-     default:
- 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
-@@ -841,6 +847,7 @@ SSL_OptionGetDefault(PRInt32 which, PRBool *pOn)
-     case SSL_REQUIRE_SAFE_NEGOTIATION: 
-                                   on = ssl_defaults.requireSafeNegotiation; 
- 				  break;
-+    case SSL_ENABLE_FALSE_START:  on = ssl_defaults.enableFalseStart;   break;
- 
-     default:
- 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
-@@ -984,6 +991,10 @@ SSL_OptionSetDefault(PRInt32 which, PRBool on)
- 	ssl_defaults.requireSafeNegotiation = on;
- 	break;
- 
-+      case SSL_ENABLE_FALSE_START:
-+	ssl_defaults.enableFalseStart = on;
-+	break;
-+
-       default:
- 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
- 	return SECFailure;
-diff --git a/mozilla/security/nss/tests/ssl/sslstress.txt b/mozilla/security/nss/tests/ssl/sslstress.txt
-index 9a3aae8..c2a5c76 100644
---- a/mozilla/security/nss/tests/ssl/sslstress.txt
-+++ b/mozilla/security/nss/tests/ssl/sslstress.txt
-@@ -42,9 +42,11 @@
-   noECC     0      _         -c_1000_-C_A                  Stress SSL2 RC4 128 with MD5
-   noECC     0      _         -c_1000_-C_c_-T               Stress SSL3 RC4 128 with MD5
-   noECC     0      _         -c_1000_-C_c                  Stress TLS  RC4 128 with MD5
-+  noECC     0      _         -c_1000_-C_c_-h               Stress TLS  RC4 128 with MD5 (false start)
-   noECC     0      -u        -2_-c_1000_-C_c_-u            Stress TLS  RC4 128 with MD5 (session ticket)
-   noECC     0      -z        -2_-c_1000_-C_c_-z            Stress TLS  RC4 128 with MD5 (compression)
-   noECC     0      -u_-z     -2_-c_1000_-C_c_-u_-z         Stress TLS  RC4 128 with MD5 (session ticket, compression)
-+  noECC     0      -u_-z     -2_-c_1000_-C_c_-u_-z_-h      Stress TLS  RC4 128 with MD5 (session ticket, compression, false start)
-   SNI       0      -u_-a_Host-sni.Dom -2_-3_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI)
- 
- #
-@@ -55,7 +57,9 @@
-   noECC     0      -r_-r     -c_100_-C_c_-N_-n_TestUser    Stress TLS RC4 128 with MD5 (no reuse, client auth)
-   noECC     0      -r_-r_-u  -2_-c_100_-C_c_-n_TestUser_-u Stress TLS RC4 128 with MD5 (session ticket, client auth)
-   noECC     0      -r_-r_-z  -2_-c_100_-C_c_-n_TestUser_-z Stress TLS RC4 128 with MD5 (compression, client auth)
-+  noECC     0      -r_-r_-z  -2_-c_100_-C_c_-n_TestUser_-z_-h Stress TLS RC4 128 with MD5 (compression, client auth, false start)
-   noECC     0   -r_-r_-u_-z  -2_-c_100_-C_c_-n_TestUser_-u_-z Stress TLS RC4 128 with MD5 (session ticket, compression, client auth)
-+  noECC     0   -r_-r_-u_-z  -2_-c_100_-C_c_-n_TestUser_-u_-z_-h Stress TLS RC4 128 with MD5 (session ticket, compression, client auth, false start)
-   SNI       0   -r_-r_-u_-a_Host-sni.Dom -2_-3_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, default virt host)
-   SNI       0   -r_-r_-u_-a_Host-sni.Dom_-k_Host-sni.Dom -2_-3_-c_1000_-C_c_-u_-a_Host-sni.Dom Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, change virt host)
- 
diff --git a/net/third_party/nss/ssl/ssl.h b/net/third_party/nss/ssl/ssl.h
index 0bc02f8..b0e77df 100644
--- a/net/third_party/nss/ssl/ssl.h
+++ b/net/third_party/nss/ssl/ssl.h
@@ -128,17 +128,6 @@ SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd);
                                           /* Renegotiation  Info (RI)       */
 					  /* extension in ALL handshakes.   */
                                           /* default: off                   */
-#define SSL_ENABLE_FALSE_START	       22 /* Enable SSL false start (off by */
-					  /* default, applies only to       */
-					  /* clients). False start is a     */
-/* mode where an SSL client will start sending application data before      */
-/* verifying the server's Finished message. This means that we could end up */
-/* sending data to an imposter. However, the data will be encrypted and     */
-/* only the true server can derive the session key. Thus, so long as the    */
-/* cipher isn't broken this is safe. Because of this, False Start will only */
-/* occur on RSA or DH ciphersuites where the cipher's key length is >= 80   */
-/* bits. The advantage of False Start is that it saves a round trip for     */
-/* client-speaks-first protocols when performing a full handshake.          */
 
 #ifdef SSL_DEPRECATED_FUNCTION 
 /* Old deprecated function names */
diff --git a/net/third_party/nss/ssl/ssl3con.c b/net/third_party/nss/ssl/ssl3con.c
index 24dc01c..545e51e 100644
--- a/net/third_party/nss/ssl/ssl3con.c
+++ b/net/third_party/nss/ssl/ssl3con.c
@@ -5657,17 +5657,7 @@ ssl3_RestartHandshakeAfterCertReq(sslSocket *         ss,
     return rv;
 }
 
-PRBool
-ssl3_CanFalseStart(sslSocket *ss) {
-    return ss->opt.enableFalseStart &&
-	   !ss->sec.isServer &&
-	   !ss->ssl3.hs.isResuming &&
-	   ss->ssl3.cwSpec &&
-	   ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
-	   (ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_rsa ||
-	    ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_dh  ||
-	    ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_ecdh);
-}
+
 
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 Server Hello Done message.
@@ -5745,12 +5735,6 @@ ssl3_HandleServerHelloDone(sslSocket *ss)
 	ss->ssl3.hs.ws = wait_new_session_ticket;
     else
 	ss->ssl3.hs.ws = wait_change_cipher;
-
-    /* Do the handshake callback for sslv3 here. */
-    if (ss->handshakeCallback != NULL && ssl3_CanFalseStart(ss)) {
-	(ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
-    }
-
     return SECSuccess;
 
 loser:
@@ -8525,7 +8509,7 @@ xmit_loser:
     ss->ssl3.hs.ws = idle_handshake;
 
     /* Do the handshake callback for sslv3 here. */
-    if (ss->handshakeCallback != NULL && !ssl3_CanFalseStart(ss)) {
+    if (ss->handshakeCallback != NULL) {
 	(ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
     }
 
diff --git a/net/third_party/nss/ssl/ssl3gthr.c b/net/third_party/nss/ssl/ssl3gthr.c
index 28fe154..bdd2958 100644
--- a/net/third_party/nss/ssl/ssl3gthr.c
+++ b/net/third_party/nss/ssl/ssl3gthr.c
@@ -188,7 +188,6 @@ ssl3_GatherCompleteHandshake(sslSocket *ss, int flags)
 {
     SSL3Ciphertext cText;
     int            rv;
-    PRBool         canFalseStart = PR_FALSE;
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
     do {
@@ -208,17 +207,7 @@ ssl3_GatherCompleteHandshake(sslSocket *ss, int flags)
 	if (rv < 0) {
 	    return ss->recvdCloseNotify ? 0 : rv;
 	}
-
-	if (ss->opt.enableFalseStart) {
-	    ssl_GetSSL3HandshakeLock(ss);
-	    canFalseStart = (ss->ssl3.hs.ws == wait_change_cipher ||
-			     ss->ssl3.hs.ws == wait_new_session_ticket) &&
-		            ssl3_CanFalseStart(ss);
-	    ssl_ReleaseSSL3HandshakeLock(ss);
-	}
-    } while (ss->ssl3.hs.ws != idle_handshake &&
-             !canFalseStart &&
-             ss->gs.buf.len == 0);
+    } while (ss->ssl3.hs.ws != idle_handshake && ss->gs.buf.len == 0);
 
     ss->gs.readOffset = 0;
     ss->gs.writeOffset = ss->gs.buf.len;
diff --git a/net/third_party/nss/ssl/sslimpl.h b/net/third_party/nss/ssl/sslimpl.h
index a800d56..0658d2c 100644
--- a/net/third_party/nss/ssl/sslimpl.h
+++ b/net/third_party/nss/ssl/sslimpl.h
@@ -338,7 +338,6 @@ typedef struct sslOptionsStr {
     unsigned int enableDeflate          : 1;  /* 19 */
     unsigned int enableRenegotiation    : 2;  /* 20-21 */
     unsigned int requireSafeNegotiation : 1;  /* 22 */
-    unsigned int enableFalseStart       : 1;  /* 23 */
 } sslOptions;
 
 typedef enum { sslHandshakingUndetermined = 0,
@@ -1267,8 +1266,6 @@ extern void      ssl_SetAlwaysBlock(sslSocket *ss);
 
 extern SECStatus ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled);
 
-extern PRBool    ssl3_CanFalseStart(sslSocket *ss);
-
 #define SSL_LOCK_READER(ss)		if (ss->recvLock) PZ_Lock(ss->recvLock)
 #define SSL_UNLOCK_READER(ss)		if (ss->recvLock) PZ_Unlock(ss->recvLock)
 #define SSL_LOCK_WRITER(ss)		if (ss->sendLock) PZ_Lock(ss->sendLock)
diff --git a/net/third_party/nss/ssl/sslsecur.c b/net/third_party/nss/ssl/sslsecur.c
index a8184478..80c2ba6 100644
--- a/net/third_party/nss/ssl/sslsecur.c
+++ b/net/third_party/nss/ssl/sslsecur.c
@@ -148,12 +148,6 @@ ssl_Do1stHandshake(sslSocket *ss)
 	    ss->gs.readOffset  = 0;
 	    break;
 	}
-	if (ss->version >= SSL_LIBRARY_VERSION_3_0 &&
-	    (ss->ssl3.hs.ws == wait_change_cipher ||
-	     ss->ssl3.hs.ws == wait_new_session_ticket) &&
-	    ssl3_CanFalseStart(ss)) {
-	    break;
-	}
 	rv = (*ss->handshake)(ss);
 	++loopCount;
     /* This code must continue to loop on SECWouldBlock, 
diff --git a/net/third_party/nss/ssl/sslsock.c b/net/third_party/nss/ssl/sslsock.c
index c4611a0..722fe60 100644
--- a/net/third_party/nss/ssl/sslsock.c
+++ b/net/third_party/nss/ssl/sslsock.c
@@ -184,7 +184,6 @@ static sslOptions ssl_defaults = {
     PR_FALSE,   /* enableDeflate      */
     2,          /* enableRenegotiation (default: requires extension) */
     PR_FALSE,   /* requireSafeNegotiation */
-    PR_FALSE,   /* enableFalseStart   */
 };
 
 sslSessionIDLookupFunc  ssl_sid_lookup;
@@ -734,10 +733,6 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 which, PRBool on)
 	ss->opt.requireSafeNegotiation = on;
 	break;
 
-      case SSL_ENABLE_FALSE_START:
-	ss->opt.enableFalseStart = on;
-	break;
-
       default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
 	rv = SECFailure;
@@ -801,7 +796,6 @@ SSL_OptionGet(PRFileDesc *fd, PRInt32 which, PRBool *pOn)
                                   on = ss->opt.enableRenegotiation; break;
     case SSL_REQUIRE_SAFE_NEGOTIATION: 
                                   on = ss->opt.requireSafeNegotiation; break;
-    case SSL_ENABLE_FALSE_START:  on = ss->opt.enableFalseStart;   break;
 
     default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
@@ -852,7 +846,6 @@ SSL_OptionGetDefault(PRInt32 which, PRBool *pOn)
     case SSL_REQUIRE_SAFE_NEGOTIATION: 
                                   on = ssl_defaults.requireSafeNegotiation; 
 				  break;
-    case SSL_ENABLE_FALSE_START:  on = ssl_defaults.enableFalseStart;   break;
 
     default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
@@ -996,10 +989,6 @@ SSL_OptionSetDefault(PRInt32 which, PRBool on)
 	ssl_defaults.requireSafeNegotiation = on;
 	break;
 
-      case SSL_ENABLE_FALSE_START:
-	ssl_defaults.enableFalseStart = on;
-	break;
-
       default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
 	return SECFailure;