Bug 884334 - Make sure WidgetShutdownObserver doesn't attempt to use the widget pointer after it has been destroyed. r=roc
authorMatt Woodrow <mwoodrow@mozilla.com>
Wed, 19 Jun 2013 14:21:01 +1200
changeset 147036 171ec5d1724d031ec4b6ee7f03b911390f15bf93
parent 147035 8d00587e9c297f3e96cf26b1d6f454abe8062cb6
child 147037 2e1acd3b9ce881c96c0742bad38ce83ae2c02342
push id2697
push userbbajaj@mozilla.com
push dateMon, 05 Aug 2013 18:49:53 +0000
treeherdermozilla-beta@dfec938c7b63 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs884334
milestone24.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 884334 - Make sure WidgetShutdownObserver doesn't attempt to use the widget pointer after it has been destroyed. r=roc
widget/xpwidgets/nsBaseWidget.cpp
widget/xpwidgets/nsBaseWidget.h
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -125,17 +125,18 @@ nsBaseWidget::nsBaseWidget()
 
 NS_IMPL_ISUPPORTS1(WidgetShutdownObserver, nsIObserver)
 
 NS_IMETHODIMP
 WidgetShutdownObserver::Observe(nsISupports *aSubject,
                                 const char *aTopic,
                                 const PRUnichar *aData)
 {
-  if (strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID) == 0) {
+  if (strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID) == 0 &&
+      mWidget) {
     mWidget->Shutdown();
     nsContentUtils::UnregisterShutdownObserver(this);
   }
  return NS_OK;
 }
 
 void
 nsBaseWidget::Shutdown()
@@ -190,16 +191,21 @@ nsBaseWidget::~nsBaseWidget()
   }
 
   if (mLayerManager) {
     mLayerManager->Destroy();
     mLayerManager = nullptr;
   }
 
   if (mShutdownObserver) {
+    // If the shutdown observer is currently processing observers,
+    // then UnregisterShutdownObserver won't stop our Observer
+    // function from being called. Make sure we don't try
+    // to reference the dead widget.
+    mShutdownObserver->mWidget = nullptr;
     nsContentUtils::UnregisterShutdownObserver(mShutdownObserver);
   }
 
   DestroyCompositor();
 
 #ifdef NOISY_WIDGET_LEAKS
   gNumWidgets--;
   printf("WIDGETS- = %d\n", gNumWidgets);
--- a/widget/xpwidgets/nsBaseWidget.h
+++ b/widget/xpwidgets/nsBaseWidget.h
@@ -46,17 +46,16 @@ class WidgetShutdownObserver MOZ_FINAL :
 public:
   WidgetShutdownObserver(nsBaseWidget* aWidget)
     : mWidget(aWidget)
   { }
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSIOBSERVER
 
-private:
   nsBaseWidget *mWidget;
 };
 
 /**
  * Common widget implementation used as base class for native
  * or crossplatform implementations of Widgets. 
  * All cross-platform behavior that all widgets need to implement 
  * should be placed in this class.