Bug 996487: don't null out mThread while committing thread suicide r=bsmedberg

content/media/AudioStream.cpp

@@ -521,7 +521,11 @@ AudioInitTask::Run()
   MOZ_ASSERT(mThread);
   if (NS_IsMainThread()) {
     mThread->Shutdown(); // can't Shutdown from the thread itself, darn
-    mThread = nullptr;
+    // Don't null out mThread!
+    // See bug 999104.  We must hold a ref to the thread across Dispatch()
+    // since the internal mThread ref could be released while processing
+    // the Dispatch(), and Dispatch/PutEvent itself doesn't hold a ref; it
+    // assumes the caller does.
     return NS_OK;
   }
 

content/media/AudioStream.h

@@ -445,6 +445,7 @@ public:
     // Can't add 'this' as the event to run, since mThread may not be set yet
     nsresult rv = NS_NewNamedThread("CubebInit", getter_AddRefs(mThread));
     if (NS_SUCCEEDED(rv)) {
+      // Note: event must not null out mThread!
       rv = mThread->Dispatch(this, NS_DISPATCH_NORMAL);
     }
     return rv;

security/manager/ssl/src/CryptoTask.cpp

@@ -46,7 +46,11 @@ CryptoTask::Run()
     if (mThread) {
       // Don't leak threads!
       mThread->Shutdown(); // can't Shutdown from the thread itself, darn
-      mThread = nullptr;
+      // Don't null out mThread!
+      // See bug 999104.  We must hold a ref to the thread across Dispatch()
+      // since the internal mThread ref could be released while processing
+      // the Dispatch(), and Dispatch/PutEvent itself doesn't hold a ref; it
+      // assumes the caller does.
     }
   }
 

security/manager/ssl/src/CryptoTask.h

@@ -42,6 +42,7 @@ public:
     // Can't add 'this' as the event to run, since mThread may not be set yet
     nsresult rv = NS_NewNamedThread(taskThreadName, getter_AddRefs(mThread));
     if (NS_SUCCEEDED(rv)) {
+      // Note: event must not null out mThread!
       rv = mThread->Dispatch(this, NS_DISPATCH_NORMAL);
     }
     return rv;