Bug 1430039 - Proxy release some member on main thread r=valentin
The reason of the crash is that the load group is released on non main thread. To fix the crash, simply use |NS_ReleaseOnMainThreadSystemGroup| to release the load group.
Note that this patch also proxy release other members on main thread just for safe.
Differential Revision:
https://phabricator.services.mozilla.com/D9258
--- a/modules/libjar/nsJARChannel.cpp
+++ b/modules/libjar/nsJARChannel.cpp
@@ -206,18 +206,33 @@ nsJARChannel::nsJARChannel()
LOG(("nsJARChannel::nsJARChannel [this=%p]\n", this));
// hold an owning reference to the jar handler
mJarHandler = gJarHandler;
}
nsJARChannel::~nsJARChannel()
{
LOG(("nsJARChannel::~nsJARChannel [this=%p]\n", this));
+ if (NS_IsMainThread()) {
+ return;
+ }
+
+ // Proxy release the following members to main thread.
NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mLoadInfo",
mLoadInfo.forget());
+ NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mCallbacks",
+ mCallbacks.forget());
+ NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mProgressSink",
+ mProgressSink.forget());
+ NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mLoadGroup",
+ mLoadGroup.forget());
+ NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mListener",
+ mListener.forget());
+ NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mListenerContext",
+ mListenerContext.forget());
}
NS_IMPL_ISUPPORTS_INHERITED(nsJARChannel,
nsHashPropertyBag,
nsIRequest,
nsIChannel,
nsIStreamListener,
nsIRequestObserver,