Bug 1339617 - move GetClosure call prior to canceling timer; r=mayhemer
authorNathan Froyd <froydnj@mozilla.com>
Tue, 21 Feb 2017 13:35:52 -0500
changeset 373177 d540146b50b30e39ace04623bf8f7f3e21573b6b
parent 373176 b8ecc482d087b47df5cc9a95549f2b5f642c3b85
child 373178 851149e5e759b0395c047fe38af7a858d9ba7fde
push id10863
push userjlorenzo@mozilla.com
push dateMon, 06 Mar 2017 23:02:23 +0000
treeherdermozilla-aurora@0931190cd725 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmayhemer
bugs1339617
milestone54.0a1
Bug 1339617 - move GetClosure call prior to canceling timer; r=mayhemer Some recent work on timers changed how we handle callbacks and associated closure data: prior to these changes, canceling timers would not null out associated closure data, so calling GetClosure() on a timer after canceling it would return what you had put in. After these changes, however, GetClosure() after cancellation would retrieve a null value, causing anything that assumed non-nullness to crash. The simple fix is to move the GetClosure() call prior to Cancel()'ing the timer.
netwerk/cache/nsDeleteDir.cpp
--- a/netwerk/cache/nsDeleteDir.cpp
+++ b/netwerk/cache/nsDeleteDir.cpp
@@ -75,20 +75,20 @@ nsDeleteDir::Shutdown(bool finishDeletin
 
     if (!finishDeleting)
       gInstance->mStopDeleting = true;
 
     // remove all pending timers
     for (int32_t i = gInstance->mTimers.Count(); i > 0; i--) {
       nsCOMPtr<nsITimer> timer = gInstance->mTimers[i-1];
       gInstance->mTimers.RemoveObjectAt(i-1);
-      timer->Cancel();
 
       nsCOMArray<nsIFile> *arg;
       timer->GetClosure((reinterpret_cast<void**>(&arg)));
+      timer->Cancel();
 
       if (finishDeleting)
         dirsToRemove.AppendObjects(*arg);
 
       // delete argument passed to the timer
       delete arg;
     }