From a966f41d5c34dec55814ef224261b87343281c0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= Date: Tue, 24 Sep 2019 16:50:02 +0000 Subject: [PATCH] Bug 1574004 - Ensure not to leak disposer if UI thread is shot down. r=snorp,agi I've hit this in one of my try runs and looks trivial to fix. The already_AddRefed destructor asserts when leaked. We should just not allow to let it go out of scope without moving the pointer. Differential Revision: https://phabricator.services.mozilla.com/D46942 --HG-- extra : moz-landing-system : lando --- widget/android/nsWindow.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp index cd5ead250435..a6b8fcc3b6d2 100644 --- a/widget/android/nsWindow.cpp +++ b/widget/android/nsWindow.cpp @@ -428,6 +428,7 @@ class nsWindow::NPZCSupport final using Base::DisposeNative; void OnDetach(already_AddRefed aDisposer) { + RefPtr disposer = aDisposer; // There are several considerations when shutting down NPZC. 1) The // Gecko thread may destroy NPZC at any time when nsWindow closes. 2) // There may be pending events on the Gecko thread when NPZC is @@ -468,7 +469,7 @@ class nsWindow::NPZCSupport final uiThread->Dispatch(NS_NewRunnableFunction( "NPZCSupport::OnDetach", - [npzc, disposer = RefPtr(aDisposer)] { + [npzc, disposer = std::move(disposer)] { npzc->SetAttached(false); disposer->Run(); })); @@ -852,6 +853,7 @@ class nsWindow::LayerViewSupport final using Base::DisposeNative; void OnDetach(already_AddRefed aDisposer) { + RefPtr disposer = aDisposer; if (RefPtr uiThread = GetAndroidUiThread()) { GeckoSession::Compositor::GlobalRef compositor(mCompositor); if (!compositor) { @@ -860,7 +862,7 @@ class nsWindow::LayerViewSupport final uiThread->Dispatch(NS_NewRunnableFunction( "LayerViewSupport::OnDetach", - [compositor, disposer = RefPtr(aDisposer), + [compositor, disposer = std::move(disposer), results = &mCapturePixelsResults, window = &mWindow] { if (LockedWindowPtr lock{*window}) { while (!results->empty()) {