Bug 1577311 - Ensure the js object is dropped while the holder is unlinked and destructored; r=baku a=RyanVM
authorTom Tung <shes050117@gmail.com>
Fri, 04 Oct 2019 16:32:38 +0000
changeset 555588 a465465b5d98489b8e60d6cedd71135af18b4cc7
parent 555587 d18091b73cc47c4b228154c2f9a4ee79a147cc56
child 555589 446ced23746d4f16072941c400f0b3758a5d4ea7
push id2165
push userffxbld-merge
push dateMon, 14 Oct 2019 16:30:58 +0000
treeherdermozilla-release@0eae18af659f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbaku, RyanVM
bugs1577311
milestone70.0
Bug 1577311 - Ensure the js object is dropped while the holder is unlinked and destructored; r=baku a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D47218
dom/file/Blob.cpp
--- a/dom/file/Blob.cpp
+++ b/dom/file/Blob.cpp
@@ -312,34 +312,34 @@ class BlobBodyStreamHolder final : publi
     mStream = aBody;
   }
 
   JSObject* GetReadableStreamBody() override { return mStream; }
 
   // Public to make trace happy.
   JS::Heap<JSObject*> mStream;
 
- private:
-  ~BlobBodyStreamHolder() = default;
+ protected:
+  virtual ~BlobBodyStreamHolder() { NullifyStream(); }
 };
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(BlobBodyStreamHolder)
 
 NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(BlobBodyStreamHolder,
                                                BodyStreamHolder)
   NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mStream)
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(BlobBodyStreamHolder,
                                                   BodyStreamHolder)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(BlobBodyStreamHolder,
                                                 BodyStreamHolder)
-  tmp->mStream = nullptr;
+  tmp->NullifyStream();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ADDREF_INHERITED(BlobBodyStreamHolder, BodyStreamHolder)
 NS_IMPL_RELEASE_INHERITED(BlobBodyStreamHolder, BodyStreamHolder)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(BlobBodyStreamHolder)
 NS_INTERFACE_MAP_END_INHERITING(BodyStreamHolder)