Bug 571225 - Crash in [@ SendSyncMessageToParent] , r=mfinkle
authorOlli Pettay <Olli.Pettay@helsinki.fi>
Fri, 11 Jun 2010 14:14:01 +0300
changeset 43507 6ea935d3c365a57ab479e74422adf8651ce468a6
parent 43506 1acc7e31ee7c346028656c91398e865e7e6b01b0
child 43508 581906c32c8427fc34d9c90eb0ba7d0ea27f6b3b
push id13742
push useropettay@mozilla.com
push dateFri, 11 Jun 2010 11:27:47 +0000
treeherdermozilla-central@6ea935d3c365 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmfinkle
bugs571225
milestone1.9.3a6pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 571225 - Crash in [@ SendSyncMessageToParent] , r=mfinkle
content/base/src/nsInProcessTabChildGlobal.cpp
content/base/src/nsInProcessTabChildGlobal.h
--- a/content/base/src/nsInProcessTabChildGlobal.cpp
+++ b/content/base/src/nsInProcessTabChildGlobal.cpp
@@ -52,38 +52,41 @@
 
 bool SendSyncMessageToParent(void* aCallbackData,
                              const nsAString& aMessage,
                              const nsAString& aJSON,
                              nsTArray<nsString>* aJSONRetVal)
 {
   nsInProcessTabChildGlobal* tabChild =
     static_cast<nsInProcessTabChildGlobal*>(aCallbackData);
-  PRInt32 count = tabChild->mASyncMessages.Count();
-  for (PRInt32 i = 0; i < count; ++i) {
-    nsCOMPtr<nsIRunnable> async = tabChild->mASyncMessages.SafeObjectAt(i);
+  nsCOMPtr<nsIContent> owner = tabChild->mOwner;
+  nsTArray<nsCOMPtr<nsIRunnable> > asyncMessages;
+  asyncMessages.SwapElements(tabChild->mASyncMessages);
+  PRUint32 len = asyncMessages.Length();
+  for (PRInt32 i = 0; i < len; ++i) {
+    nsCOMPtr<nsIRunnable> async = asyncMessages[i];
     async->Run();
   }
   if (tabChild->mChromeMessageManager) {
-    tabChild->mChromeMessageManager->ReceiveMessage(tabChild->mOwner, aMessage, PR_TRUE,
+    tabChild->mChromeMessageManager->ReceiveMessage(owner, aMessage, PR_TRUE,
                                                     aJSON, nsnull, aJSONRetVal);
   }
   return true;
 }
 
 class nsAsyncMessageToParent : public nsRunnable
 {
 public:
   nsAsyncMessageToParent(nsInProcessTabChildGlobal* aTabChild,
                          const nsAString& aMessage, const nsAString& aJSON)
     : mTabChild(aTabChild), mMessage(aMessage), mJSON(aJSON) {}
 
   NS_IMETHOD Run()
   {
-    mTabChild->mASyncMessages.RemoveObject(this);
+    mTabChild->mASyncMessages.RemoveElement(this);
     if (mTabChild->mChromeMessageManager) {
       mTabChild->mChromeMessageManager->ReceiveMessage(mTabChild->mOwner, mMessage,
                                                        PR_FALSE,
                                                        mJSON, nsnull, nsnull);
     }
     return NS_OK;
   }
   nsRefPtr<nsInProcessTabChildGlobal> mTabChild;
@@ -92,18 +95,19 @@ public:
 };
 
 bool SendAsyncMessageToParent(void* aCallbackData,
                               const nsAString& aMessage,
                               const nsAString& aJSON)
 {
   nsInProcessTabChildGlobal* tabChild =
     static_cast<nsInProcessTabChildGlobal*>(aCallbackData);
-  nsRefPtr<nsIRunnable> ev = new nsAsyncMessageToParent(tabChild, aMessage, aJSON);
-  tabChild->mASyncMessages.AppendObject(ev);
+  nsCOMPtr<nsIRunnable> ev =
+    new nsAsyncMessageToParent(tabChild, aMessage, aJSON);
+  tabChild->mASyncMessages.AppendElement(ev);
   NS_DispatchToCurrentThread(ev);
   return true;
 }
 
 static int tabChildC = 0;
 nsInProcessTabChildGlobal::nsInProcessTabChildGlobal(nsIDocShell* aShell,
                                                      nsIContent* aOwner,
                                                      nsFrameMessageManager* aChrome)
--- a/content/base/src/nsInProcessTabChildGlobal.h
+++ b/content/base/src/nsInProcessTabChildGlobal.h
@@ -131,12 +131,12 @@ protected:
   nsCOMPtr<nsIPrincipal> mPrincipal;
   nsCOMPtr<nsIDocShell> mDocShell;
   PRPackedBool mInitialized;
   PRPackedBool mLoadingScript;
   PRPackedBool mDelayedDisconnect;
 public:
   nsIContent* mOwner;
   nsFrameMessageManager* mChromeMessageManager;
-  nsCOMArray<nsIRunnable> mASyncMessages;
+  nsTArray<nsCOMPtr<nsIRunnable> > mASyncMessages;
 };
 
 #endif