Bug 1044443 - release off main thread crash in nsXPCWrappedJS::Release() via nsUpdateProcessor::~nsUpdateProcessor(). r=bbondy
authorRobert Strong <robert.bugzilla@gmail.com>
Wed, 18 Feb 2015 16:05:00 -0800
changeset 229672 b596d5ffe50f3be8ea1c29036487bd20d9e415ab
parent 229671 72481fdb360538f0c90bb2fd546a2cf0a47481ac
child 229673 584bbe0e1cd8a913724129d8326ee31fe0ab8c69
push id55789
push userrstrong@mozilla.com
push dateThu, 19 Feb 2015 00:05:04 +0000
treeherdermozilla-inbound@b596d5ffe50f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbbondy
bugs1044443
milestone38.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1044443 - release off main thread crash in nsXPCWrappedJS::Release() via nsUpdateProcessor::~nsUpdateProcessor(). r=bbondy
toolkit/mozapps/update/nsUpdateService.js
toolkit/xre/nsUpdateDriver.cpp
toolkit/xre/nsUpdateDriver.h
--- a/toolkit/mozapps/update/nsUpdateService.js
+++ b/toolkit/mozapps/update/nsUpdateService.js
@@ -3525,17 +3525,21 @@ UpdateManager.prototype = {
         }
       }
 
       this._writeUpdatesToXMLFile(updates.slice(0, 10),
                                   getUpdateFile([FILE_UPDATES_DB]));
     }
   },
 
-  refreshUpdateStatus: function UM_refreshUpdateStatus(update) {
+  /**
+   * See nsIUpdateService.idl
+   */
+  refreshUpdateStatus: function UM_refreshUpdateStatus(aUpdate) {
+    var update = this._activeUpdate ? this._activeUpdate : aUpdate;
     var updateSucceeded = true;
     var status = readStatusFile(getUpdatesDir());
     var ary = status.split(":");
     update.state = ary[0];
     if (update.state == STATE_FAILED && ary[1]) {
       updateSucceeded = false;
       if (!handleUpdateFailure(update, ary[1])) {
         handleFallbackToCompleteUpdate(update, true);
--- a/toolkit/xre/nsUpdateDriver.cpp
+++ b/toolkit/xre/nsUpdateDriver.cpp
@@ -1165,18 +1165,16 @@ nsUpdateProcessor::ProcessUpdate(nsIUpda
                                getter_AddRefs(mInfo.mOSApplyToDir));
     if (NS_FAILED(rv)) {
       LOG(("Can't create nsIFile for OS apply to dir"));
       return rv;
     }
   }
 #endif
 
-  mUpdate = aUpdate;
-
   MOZ_ASSERT(NS_IsMainThread(), "not main thread");
   return NS_NewThread(getter_AddRefs(mProcessWatcher),
                       NS_NewRunnableMethod(this, &nsUpdateProcessor::StartStagedUpdate));
 }
 
 
 
 void
@@ -1210,17 +1208,16 @@ nsUpdateProcessor::StartStagedUpdate()
 }
 
 void
 nsUpdateProcessor::ShutdownWatcherThread()
 {
   MOZ_ASSERT(NS_IsMainThread(), "not main thread");
   mProcessWatcher->Shutdown();
   mProcessWatcher = nullptr;
-  mUpdate = nullptr;
 }
 
 void
 nsUpdateProcessor::WaitForProcess()
 {
   MOZ_ASSERT(!NS_IsMainThread(), "main thread");
   ::WaitForProcess(mUpdaterPID);
   NS_DispatchToMainThread(NS_NewRunnableMethod(this, &nsUpdateProcessor::UpdateDone));
@@ -1228,15 +1225,19 @@ nsUpdateProcessor::WaitForProcess()
 
 void
 nsUpdateProcessor::UpdateDone()
 {
   MOZ_ASSERT(NS_IsMainThread(), "not main thread");
 
   nsCOMPtr<nsIUpdateManager> um =
     do_GetService("@mozilla.org/updates/update-manager;1");
-  if (um && mUpdate) {
-    um->RefreshUpdateStatus(mUpdate);
+  if (um) {
+    nsCOMPtr<nsIUpdate> update;
+    um->GetActiveUpdate(getter_AddRefs(update));
+    if (update) {
+      um->RefreshUpdateStatus(update);
+    }
   }
 
   ShutdownWatcherThread();
 }
 
--- a/toolkit/xre/nsUpdateDriver.h
+++ b/toolkit/xre/nsUpdateDriver.h
@@ -100,14 +100,13 @@ private:
   void StartStagedUpdate();
   void WaitForProcess();
   void UpdateDone();
   void ShutdownWatcherThread();
 
 private:
   ProcessType mUpdaterPID;
   nsCOMPtr<nsIThread> mProcessWatcher;
-  nsCOMPtr<nsIUpdate> mUpdate;
   StagedUpdateInfo mInfo;
 };
 #endif
 
 #endif  // nsUpdateDriver_h__