Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-29 15:52:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Don't hold nsProxyObjectManager's lock while calling delete on an nsProxyEventObject. (Bug 650674) r=bsmedberg

Browse Source
This commit is contained in:
L. David Baron 2011-04-19 21:22:39 -07:00
parent b570f6fe2a
commit f69222ff51
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
xpcom/proxy/src/nsProxyEvent.cpp
View File

@ -427,7 +427,9 @@ nsresult
nsProxyObject::LockedFind(REFNSIID aIID, void **aResult)
{
// This method is only called when the global lock is held.
// XXX assert this
#ifdef DEBUG
nsProxyObjectManager::GetInstance()->GetLock().AssertCurrentThreadOwns();
#endif
nsProxyEventObject *peo;
@ -442,8 +444,8 @@ nsProxyObject::LockedFind(REFNSIID aIID, void **aResult)
nsProxyEventObject *newpeo;
// Both GetClass and QueryInterface call out to XPCOM, so we unlock for them
nsProxyObjectManager* pom = nsProxyObjectManager::GetInstance();
{
nsProxyObjectManager* pom = nsProxyObjectManager::GetInstance();
MutexAutoUnlock unlock(pom->GetLock());
nsProxyEventClass *pec;
@ -473,7 +475,13 @@ nsProxyObject::LockedFind(REFNSIID aIID, void **aResult)
// linked-list check.
for (peo = mFirst; peo; peo = peo->mNext) {
if (peo->GetClass()->GetProxiedIID().Equals(aIID)) {
delete newpeo;
{
// Deleting an nsProxyEventObject can call Release on an
// nsProxyObject, which can only happen when not holding
// the lock.
MutexAutoUnlock unlock(pom->GetLock());
delete newpeo;
}
*aResult = static_cast<nsISupports*>(peo->mXPTCStub);
peo->LockedAddRef();
return NS_OK;