Bug 924348 - Intermittent PROCESS-CRASH | /tests/dom/indexedDB/test/test_add_put.html | application crashed [@ sqlite3LeaveMutexAndCloseZombie] or [@ hashDestroy]. r=khuey
authorJan Varga <jan.varga@gmail.com>
Mon, 13 Jan 2014 13:27:19 -0500
changeset 163210 d2fe5f5b558ed93ba2cc6bd34a595842f0cb2527
parent 163209 4b6572d3c2d3a541558a0a0cbb7adf88bd7faffd
child 163211 425579efbac3887d8895508932d7074d1dedcb4d
child 163213 4142d03082e1a76483be6b6736539edd749103ef
push id25984
push userryanvm@gmail.com
push dateMon, 13 Jan 2014 22:44:31 +0000
treeherdermozilla-central@425579efbac3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerskhuey
bugs924348
milestone29.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 924348 - Intermittent PROCESS-CRASH | /tests/dom/indexedDB/test/test_add_put.html | application crashed [@ sqlite3LeaveMutexAndCloseZombie] or [@ hashDestroy]. r=khuey CLOSED TREE
dom/quota/QuotaManager.cpp
dom/quota/QuotaObject.h
--- a/dom/quota/QuotaManager.cpp
+++ b/dom/quota/QuotaManager.cpp
@@ -1336,19 +1336,17 @@ QuotaManager::GetQuotaObject(Persistence
   if (exists) {
     rv = aFile->GetFileSize(&fileSize);
     NS_ENSURE_SUCCESS(rv, nullptr);
   }
   else {
     fileSize = 0;
   }
 
-  // We need this extra raw pointer because we can't assign to the smart
-  // pointer directly since QuotaObject::AddRef needs to acquire the same mutex.
-  QuotaObject* quotaObject;
+  nsRefPtr<QuotaObject> result;
   {
     MutexAutoLock lock(mQuotaMutex);
 
     GroupInfoPair* pair;
     if (!mGroupInfoPairs.Get(aGroup, &pair)) {
       return nullptr;
     }
 
@@ -1359,26 +1357,36 @@ QuotaManager::GetQuotaObject(Persistence
     }
 
     nsRefPtr<OriginInfo> originInfo = groupInfo->LockedGetOriginInfo(aOrigin);
 
     if (!originInfo) {
       return nullptr;
     }
 
+    // We need this extra raw pointer because we can't assign to the smart
+    // pointer directly since QuotaObject::AddRef would try to acquire the same
+    // mutex.
+    QuotaObject* quotaObject;
     if (!originInfo->mQuotaObjects.Get(path, &quotaObject)) {
+      // Create a new QuotaObject.
       quotaObject = new QuotaObject(originInfo, path, fileSize);
+
+      // Put it to the hashtable. The hashtable is not responsible to delete
+      // the QuotaObject.
       originInfo->mQuotaObjects.Put(path, quotaObject);
-      // The hashtable is not responsible to delete the QuotaObject.
     }
+
+    // Addref the QuotaObject and move the ownership to the result. This must
+    // happen before we unlock!
+    result = quotaObject->LockedAddRef();
   }
 
   // The caller becomes the owner of the QuotaObject, that is, the caller is
   // is responsible to delete it when the last reference is removed.
-  nsRefPtr<QuotaObject> result = quotaObject;
   return result.forget();
 }
 
 already_AddRefed<QuotaObject>
 QuotaManager::GetQuotaObject(PersistenceType aPersistenceType,
                              const nsACString& aGroup,
                              const nsACString& aOrigin,
                              const nsAString& aPath)
--- a/dom/quota/QuotaObject.h
+++ b/dom/quota/QuotaObject.h
@@ -45,16 +45,27 @@ private:
     MOZ_COUNT_CTOR(QuotaObject);
   }
 
   ~QuotaObject()
   {
     MOZ_COUNT_DTOR(QuotaObject);
   }
 
+  already_AddRefed<QuotaObject>
+  LockedAddRef()
+  {
+    AssertCurrentThreadOwnsQuotaMutex();
+
+    ++mRefCnt;
+
+    nsRefPtr<QuotaObject> result = dont_AddRef(this);
+    return result.forget();
+  }
+
   mozilla::ThreadSafeAutoRefCnt mRefCnt;
 
   OriginInfo* mOriginInfo;
   nsString mPath;
   int64_t mSize;
 };
 
 class OriginInfo