Bug 1430039 - Proxy release some member on main thread r=valentin
authorKershaw Chang <kershaw@mozilla.com>
Fri, 19 Oct 2018 14:46:21 +0000
changeset 490667 d7ba5883b259d3ba647894b7e0bf53587331df9f
parent 490666 28403444666ca113c31b269dd55d31159ac2fe6b
child 490668 6246fbfaed06dfa63fb2ee3a8007521525008caa
push id247
push userfmarier@mozilla.com
push dateSat, 27 Oct 2018 01:06:44 +0000
reviewersvalentin
bugs1430039
milestone64.0a1
Bug 1430039 - Proxy release some member on main thread r=valentin The reason of the crash is that the load group is released on non main thread. To fix the crash, simply use |NS_ReleaseOnMainThreadSystemGroup| to release the load group. Note that this patch also proxy release other members on main thread just for safe. Differential Revision: https://phabricator.services.mozilla.com/D9258
modules/libjar/nsJARChannel.cpp
--- a/modules/libjar/nsJARChannel.cpp
+++ b/modules/libjar/nsJARChannel.cpp
@@ -206,18 +206,33 @@ nsJARChannel::nsJARChannel()
     LOG(("nsJARChannel::nsJARChannel [this=%p]\n", this));
     // hold an owning reference to the jar handler
     mJarHandler = gJarHandler;
 }
 
 nsJARChannel::~nsJARChannel()
 {
     LOG(("nsJARChannel::~nsJARChannel [this=%p]\n", this));
+    if (NS_IsMainThread()) {
+        return;
+    }
+
+    // Proxy release the following members to main thread.
     NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mLoadInfo",
                                       mLoadInfo.forget());
+    NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mCallbacks",
+                                      mCallbacks.forget());
+    NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mProgressSink",
+                                      mProgressSink.forget());
+    NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mLoadGroup",
+                                      mLoadGroup.forget());
+    NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mListener",
+                                      mListener.forget());
+    NS_ReleaseOnMainThreadSystemGroup("nsJARChannel::mListenerContext",
+                                      mListenerContext.forget());
 }
 
 NS_IMPL_ISUPPORTS_INHERITED(nsJARChannel,
                             nsHashPropertyBag,
                             nsIRequest,
                             nsIChannel,
                             nsIStreamListener,
                             nsIRequestObserver,