Bug 1339617 - Move GetClosure call prior to canceling timer. r=mayhemer, a=jcristau
authorNathan Froyd <froydnj@mozilla.com>
Tue, 21 Feb 2017 13:35:52 -0500
changeset 359390 0842f492e64a2fe4b9139fed3cae0fea5a719583
parent 359389 432f86adc83ea171bda9c04a809c3eb80f1eb608
child 359391 430629581ab99aa891327e2c9d72ab47b595d928
push id10785
push userryanvm@gmail.com
push dateWed, 22 Feb 2017 16:58:40 +0000
treeherdermozilla-aurora@ba7e52e5c26a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmayhemer, jcristau
bugs1339617
milestone53.0a2
Bug 1339617 - Move GetClosure call prior to canceling timer. r=mayhemer, a=jcristau Some recent work on timers changed how we handle callbacks and associated closure data: prior to these changes, canceling timers would not null out associated closure data, so calling GetClosure() on a timer after canceling it would return what you had put in. After these changes, however, GetClosure() after cancellation would retrieve a null value, causing anything that assumed non-nullness to crash. The simple fix is to move the GetClosure() call prior to Cancel()'ing the timer.
netwerk/cache/nsDeleteDir.cpp
--- a/netwerk/cache/nsDeleteDir.cpp
+++ b/netwerk/cache/nsDeleteDir.cpp
@@ -75,20 +75,20 @@ nsDeleteDir::Shutdown(bool finishDeletin
 
     if (!finishDeleting)
       gInstance->mStopDeleting = true;
 
     // remove all pending timers
     for (int32_t i = gInstance->mTimers.Count(); i > 0; i--) {
       nsCOMPtr<nsITimer> timer = gInstance->mTimers[i-1];
       gInstance->mTimers.RemoveObjectAt(i-1);
-      timer->Cancel();
 
       nsCOMArray<nsIFile> *arg;
       timer->GetClosure((reinterpret_cast<void**>(&arg)));
+      timer->Cancel();
 
       if (finishDeleting)
         dirsToRemove.AppendObjects(*arg);
 
       // delete argument passed to the timer
       delete arg;
     }