Bug 1154389 - Stop leaking DeviceSuccessCallbackRunnable objects, and release its mOnSuccess and mOnFailure on the main thread if needed; r=jesup

dom/media/MediaManager.cpp

@@ -46,6 +46,7 @@
 #include "MediaTrackConstraints.h"
 #include "VideoUtils.h"
 #include "Latency.h"
+#include "nsProxyRelease.h"
 
 // For PR_snprintf
 #include "prprf.h"
@@ -332,6 +333,18 @@ public:
     mOnFailure.swap(aOnFailure);
   }
 
+  ~DeviceSuccessCallbackRunnable()
+  {
+    if (!NS_IsMainThread()) {
+      // This can happen if the main thread processes the runnable before
+      // GetUserMediaDevicesTask::Run returns.
+      nsCOMPtr<nsIThread> mainThread = do_GetMainThread();
+
+      NS_ProxyRelease(mainThread, mOnSuccess);
+      NS_ProxyRelease(mainThread, mOnFailure);
+    }
+  }
+
   nsresult
   AnonymizeId(nsAString& aId, const nsACString& aOriginKey)
   {
@@ -1498,10 +1511,7 @@ public:
         result->AppendElement(source);
       }
     }
-    // In the case of failure with this newly allocated runnable, we
-    // intentionally leak the runnable, because we've pawned mOnSuccess and
-    // mOnFailure onto it which are main thread objects unsafe to release here.
-    DeviceSuccessCallbackRunnable* runnable =
+    nsRefPtr<DeviceSuccessCallbackRunnable> runnable =
         new DeviceSuccessCallbackRunnable(mWindowId, mOnSuccess, mOnFailure,
                                           result.forget());
     if (mPrivileged) {