Bug 791798 - topcrash in mozilla::plugins::parent::_releaseobject because of incremental GC: we're creating a new wrapper before teardown which races with the release event. r=bsmedberg
authorGeorg Fritzsche <georg.fritzsche@googlemail.com>
Mon, 01 Oct 2012 19:53:35 +0200
changeset 109881 f6753216c72b0a96e12954effbb745bb4a40e531
parent 109880 2803709dc340deb32dc82ac4d67433cf01f7b00b
child 109882 816bba27680f9078fb127a30c83e8b5c3ac46098
push id16255
push userbsmedberg@mozilla.com
push dateWed, 10 Oct 2012 20:01:05 +0000
treeherdermozilla-inbound@f6753216c72b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbsmedberg
bugs791798
milestone19.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 791798 - topcrash in mozilla::plugins::parent::_releaseobject because of incremental GC: we're creating a new wrapper before teardown which races with the release event. r=bsmedberg
dom/plugins/base/nsJSNPRuntime.cpp
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -1946,16 +1946,20 @@ NPObjWrapperPluginDestroyedCallback(PLDH
     } else {
       PR_Free(npobj);
     }
 
     ::JS_SetPrivate(entry->mJSObj, nullptr);
 
     table->ops = ops;    
 
+    if (sDelayedReleases && sDelayedReleases->RemoveElement(npobj)) {
+      OnWrapperDestroyed();
+    }
+
     return PL_DHASH_REMOVE;
   }
 
   return PL_DHASH_NEXT;
 }
 
 // static
 void