Bug 1044443 - Release off main thread crash in nsXPCWrappedJS::Release() via nsUpdateProcessor::~nsUpdateProcessor(). r=bbondy, a=lmandel
authorRobert Strong <robert.bugzilla@gmail.com>
Wed, 18 Feb 2015 16:05:00 -0800
changeset 250110 8ac02f8d22e5
parent 250109 cae785163094
child 250111 9ff796be0d67
push id4503
push userryanvm@gmail.com
push date2015-02-27 21:34 +0000
treeherdermozilla-beta@87d76aead804 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbbondy, lmandel
bugs1044443
milestone37.0
Bug 1044443 - Release off main thread crash in nsXPCWrappedJS::Release() via nsUpdateProcessor::~nsUpdateProcessor(). r=bbondy, a=lmandel
toolkit/mozapps/update/nsUpdateService.js
toolkit/xre/nsUpdateDriver.cpp
toolkit/xre/nsUpdateDriver.h
--- a/toolkit/mozapps/update/nsUpdateService.js
+++ b/toolkit/mozapps/update/nsUpdateService.js
@@ -3518,17 +3518,21 @@ UpdateManager.prototype = {
         }
       }
 
       this._writeUpdatesToXMLFile(updates.slice(0, 10),
                                   getUpdateFile([FILE_UPDATES_DB]));
     }
   },
 
-  refreshUpdateStatus: function UM_refreshUpdateStatus(update) {
+  /**
+   * See nsIUpdateService.idl
+   */
+  refreshUpdateStatus: function UM_refreshUpdateStatus(aUpdate) {
+    var update = this._activeUpdate ? this._activeUpdate : aUpdate;
     var updateSucceeded = true;
     var status = readStatusFile(getUpdatesDir());
     var ary = status.split(":");
     update.state = ary[0];
     if (update.state == STATE_FAILED && ary[1]) {
       updateSucceeded = false;
       if (!handleUpdateFailure(update, ary[1])) {
         handleFallbackToCompleteUpdate(update, true);
--- a/toolkit/xre/nsUpdateDriver.cpp
+++ b/toolkit/xre/nsUpdateDriver.cpp
@@ -1165,18 +1165,16 @@ nsUpdateProcessor::ProcessUpdate(nsIUpda
                                getter_AddRefs(mInfo.mOSApplyToDir));
     if (NS_FAILED(rv)) {
       LOG(("Can't create nsIFile for OS apply to dir"));
       return rv;
     }
   }
 #endif
 
-  mUpdate = aUpdate;
-
   NS_ABORT_IF_FALSE(NS_IsMainThread(), "not main thread");
   return NS_NewThread(getter_AddRefs(mProcessWatcher),
                       NS_NewRunnableMethod(this, &nsUpdateProcessor::StartStagedUpdate));
 }
 
 
 
 void
@@ -1210,17 +1208,16 @@ nsUpdateProcessor::StartStagedUpdate()
 }
 
 void
 nsUpdateProcessor::ShutdownWatcherThread()
 {
   NS_ABORT_IF_FALSE(NS_IsMainThread(), "not main thread");
   mProcessWatcher->Shutdown();
   mProcessWatcher = nullptr;
-  mUpdate = nullptr;
 }
 
 void
 nsUpdateProcessor::WaitForProcess()
 {
   NS_ABORT_IF_FALSE(!NS_IsMainThread(), "main thread");
   ::WaitForProcess(mUpdaterPID);
   NS_DispatchToMainThread(NS_NewRunnableMethod(this, &nsUpdateProcessor::UpdateDone));
@@ -1228,15 +1225,19 @@ nsUpdateProcessor::WaitForProcess()
 
 void
 nsUpdateProcessor::UpdateDone()
 {
   NS_ABORT_IF_FALSE(NS_IsMainThread(), "not main thread");
 
   nsCOMPtr<nsIUpdateManager> um =
     do_GetService("@mozilla.org/updates/update-manager;1");
-  if (um && mUpdate) {
-    um->RefreshUpdateStatus(mUpdate);
+  if (um) {
+    nsCOMPtr<nsIUpdate> update;
+    um->GetActiveUpdate(getter_AddRefs(update));
+    if (update) {
+      um->RefreshUpdateStatus(update);
+    }
   }
 
   ShutdownWatcherThread();
 }
 
--- a/toolkit/xre/nsUpdateDriver.h
+++ b/toolkit/xre/nsUpdateDriver.h
@@ -100,14 +100,13 @@ private:
   void StartStagedUpdate();
   void WaitForProcess();
   void UpdateDone();
   void ShutdownWatcherThread();
 
 private:
   ProcessType mUpdaterPID;
   nsCOMPtr<nsIThread> mProcessWatcher;
-  nsCOMPtr<nsIUpdate> mUpdate;
   StagedUpdateInfo mInfo;
 };
 #endif
 
 #endif  // nsUpdateDriver_h__