Bug 1353660 - proxy destruction of nsHashPropertyBag's hash table to the main thread; r=mccr8

We need this because the stored values in the hash table may themselves
be main-thread only objects, and destroying them off the main thread
will cause crashes.
This commit is contained in:
Nathan Froyd 2017-04-05 15:31:20 -04:00
parent 5f1cb89f1b
commit 564e8d046e
2 changed files with 35 additions and 1 deletions

View File

@ -9,8 +9,10 @@
#include "nsArrayEnumerator.h"
#include "nsIVariant.h"
#include "nsIProperty.h"
#include "nsThreadUtils.h"
#include "nsVariant.h"
#include "mozilla/Attributes.h"
#include "mozilla/Move.h"
/*
* nsHashPropertyBagBase implementation.
@ -265,6 +267,38 @@ NS_INTERFACE_MAP_BEGIN(nsHashPropertyBag)
NS_INTERFACE_MAP_ENTRY(nsIWritablePropertyBag2)
NS_INTERFACE_MAP_END
/*
* We need to ensure that the hashtable is destroyed on the main thread, as
* the nsIVariant values are main-thread only objects.
*/
class ProxyHashtableDestructor final : public mozilla::Runnable
{
public:
using HashtableType = nsInterfaceHashtable<nsStringHashKey, nsIVariant>;
explicit ProxyHashtableDestructor(HashtableType&& aTable)
: mPropertyHash(mozilla::Move(aTable))
{}
NS_IMETHODIMP
Run()
{
MOZ_ASSERT(NS_IsMainThread());
HashtableType table(mozilla::Move(mPropertyHash));
return NS_OK;
}
private:
HashtableType mPropertyHash;
};
nsHashPropertyBag::~nsHashPropertyBag()
{
if (!NS_IsMainThread()) {
RefPtr<ProxyHashtableDestructor> runnable =
new ProxyHashtableDestructor(mozilla::Move(mPropertyHash));
MOZ_ALWAYS_SUCCEEDS(NS_DispatchToMainThread(runnable));
}
}
/*
* nsHashPropertyBagCC implementation.

View File

@ -39,7 +39,7 @@ public:
NS_DECL_THREADSAFE_ISUPPORTS
protected:
virtual ~nsHashPropertyBag() {}
virtual ~nsHashPropertyBag();
};
/* A cycle collected nsHashPropertyBag for main-thread-only use. */