Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-03 02:25:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 865745 - Hold a strong ref to the global for the duration that each nsFrameScriptCx is on the stack. r=smaug

Browse Source 
These things currently do a complicated refcounting dance to avoid destroying the
cx until all the consumers of it are gone. That stuff can mostly go away now that
we're just using the SafeJSContext, but DestroyCx also nulls out the global, so
we should make sure to keep that alive for anyone that might be using it.
This commit is contained in:
Bobby Holley 2013-06-30 09:00:18 -06:00
parent ba3407d692
commit b4f2e0c87d
3 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
content/base/src/nsFrameLoader.cpp
View File

@ -2224,6 +2224,7 @@ public:
nsInProcessTabChildGlobal* tabChild =
static_cast<nsInProcessTabChildGlobal*>(mFrameLoader->mChildMessageManager.get());
if (tabChild && tabChild->GetInnerManager()) {
nsCOMPtr<nsIXPConnectJSObjectHolder> kungFuDeathGrip(tabChild->GetGlobal());
nsFrameScriptCx cx(static_cast<EventTarget*>(tabChild), tabChild);
StructuredCloneData data;

5
content/base/src/nsFrameMessageManager.h
View File

@ -285,6 +285,11 @@ class nsFrameScriptExecutor
{
public:
static void Shutdown();
already_AddRefed<nsIXPConnectJSObjectHolder> GetGlobal()
{
nsCOMPtr<nsIXPConnectJSObjectHolder> ref = mGlobal;
return ref.forget();
}
protected:
friend class nsFrameScriptCx;
nsFrameScriptExecutor() : mCx(nullptr), mCxStackRefCnt(0),

2
dom/ipc/TabChild.cpp
View File

@ -1445,6 +1445,7 @@ TabChild::DispatchMessageManagerMessage(const nsAString& aMessageName,
cloneData.mDataLength = buffer.nbytes();
}
nsCOMPtr<nsIXPConnectJSObjectHolder> kungFuDeathGrip(GetGlobal());
nsFrameScriptCx frameScriptCx(static_cast<nsIWebBrowserChrome*>(this), this);
// Let the BrowserElementScrolling helper (if it exists) for this
// content manipulate the frame state.
@ -2009,6 +2010,7 @@ TabChild::RecvAsyncMessage(const nsString& aMessage,
const ClonedMessageData& aData)
{
if (mTabChildGlobal) {
nsCOMPtr<nsIXPConnectJSObjectHolder> kungFuDeathGrip(GetGlobal());
nsFrameScriptCx cx(static_cast<nsIWebBrowserChrome*>(this), this);
StructuredCloneData cloneData = UnpackClonedMessageDataForChild(aData);
nsRefPtr<nsFrameMessageManager> mm =