Bug 1240985 - Fix bug where mAwaitingSyncReply can be overwritten in Send after Cancel (r=dvander)
authorBill McCloskey <billm@mozilla.com>
Tue, 19 Jan 2016 17:32:24 -0800
changeset 280999 2020b3de24bc6b5994f1f3d3b4760eee3af79674
parent 280998 5a2a8262a3689341fd0e75d4c82c1817ca9bc496
child 281000 e7ce9369ddb692a1a9aa7fe562dab21b7a39ec97
push id29925
push userkwierso@gmail.com
push dateFri, 22 Jan 2016 00:27:20 +0000
treeherdermozilla-central@cea2883034cb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs1240985
milestone46.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1240985 - Fix bug where mAwaitingSyncReply can be overwritten in Send after Cancel (r=dvander)
ipc/glue/MessageChannel.h
--- a/ipc/glue/MessageChannel.h
+++ b/ipc/glue/MessageChannel.h
@@ -520,26 +520,32 @@ class MessageChannel : HasResultCodes
     int32_t mNextSeqno;
 
     static bool sIsPumpingMessages;
 
     template<class T>
     class AutoSetValue {
       public:
         explicit AutoSetValue(T &var, const T &newValue)
-          : mVar(var), mPrev(var)
+          : mVar(var), mPrev(var), mNew(newValue)
         {
             mVar = newValue;
         }
         ~AutoSetValue() {
-            mVar = mPrev;
+            // The value may have been zeroed if the transaction was
+            // canceled. In that case we shouldn't return it to its previous
+            // value.
+            if (mVar == mNew) {
+                mVar = mPrev;
+            }
         }
       private:
         T& mVar;
         T mPrev;
+        T mNew;
     };
 
     // Worker thread only.
     bool mAwaitingSyncReply;
     int mAwaitingSyncReplyPriority;
 
     // Set while we are dispatching a synchronous message. Only for use on the
     // worker thread.