Fix for 9963 locking crash

xpinstall/src/nsSoftwareUpdate.cpp

@@ -312,32 +312,34 @@ nsSoftwareUpdate::InstallJarCallBack()
 nsresult
 nsSoftwareUpdate::RunNextInstall()
 {
-    nsresult rv = NS_OK;
+    nsresult        rv = NS_OK;
+    nsInstallInfo*  info = nsnull;
 
     PR_Lock(mLock);
-    if (!mInstalling)
+    if (!mInstalling) 
     {
         if ( mJarInstallQueue->GetSize() > 0 )
         {
-            nsInstallInfo *info = (nsInstallInfo*)mJarInstallQueue->Get(0);
+            info = (nsInstallInfo*)mJarInstallQueue->Get(0);
 
             if ( info )
-            {
                 mInstalling = PR_TRUE;
-                RunInstall( info );
-            }
             else
                 // XXX leaks any nsInstallInfos left in queue
                 rv = NS_ERROR_NULL_POINTER;
         }
-        else
-        {
-            // nothing more to do
-            VR_Close();
-        }
+    }
+    else
+    {
+        // nothing more to do
+        VR_Close();
     }
     PR_Unlock(mLock);
 
+    // make sure to RunInstall() outside of locked section due to callbacks
+    if (info)
+        RunInstall( info );
+
     return rv;
 }
 

xpinstall/src/nsSoftwareUpdateRun.cpp

@@ -274,7 +274,7 @@ static nsresult SetupInstallContext(const char* jarFile,
 ///////////////////////////////////////////////////////////////////////////////////////////////
 PRInt32 RunInstall(nsInstallInfo *installInfo)
 {   
-    if (installInfo->GetFlags() == 0x00000001)
+    if (installInfo->GetFlags() == 0x0000FFFF) // XXX bogus value -- do we want this feature?
     {
         RunInstallOnThread((void *)installInfo);
     }