Fixing bug 58888. The content sink was incorrectly releasing the stream loader in its OnStreamComplete() method, this caused a crash when mozilla was running in off-line mode since OnStreamComplete() was called without the sink having a string reference to the stream loader so the incorrect release call in the sink caused a crash later on in necko. sr=rpotts, r=gagan,heikki

content/html/document/src/nsHTMLContentSink.cpp

@@ -4720,9 +4720,6 @@ HTMLContentSink::OnStreamComplete(nsIStreamLoader* aLoader,
   rv = ResumeParsing();
   if (NS_FAILED(rv)) return rv;
 
-  // We added a reference when the loader was created. This
-  // release should destroy it.
-  NS_RELEASE(aLoader);
   //invalidate Xfer buffer content
   mUnicodeXferBuf.SetLength(0); 
 
@@ -4915,7 +4912,7 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode)
       }
 
       nsCOMPtr<nsILoadGroup> loadGroup;
-      nsIStreamLoader* loader;
+      nsCOMPtr<nsIStreamLoader> loader;
 
       mDocument->GetDocumentLoadGroup(getter_AddRefs(loadGroup));
 
@@ -4923,8 +4920,9 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode)
       // from within this new stream loader to have proper parenting. but it's
       // not fatal if there isn't a prompter.
       nsCOMPtr<nsIInterfaceRequestor> promptcall(do_QueryInterface(mWebShell));
-      rv = NS_NewStreamLoader(&loader, mScriptURI, this, nsnull, loadGroup,
-                              promptcall, nsIChannel::FORCE_RELOAD);
+      rv = NS_NewStreamLoader(getter_AddRefs(loader), mScriptURI, this,
+                              nsnull, loadGroup, promptcall,
+                              nsIChannel::FORCE_RELOAD);
       if (NS_OK == rv) {
         rv = NS_ERROR_HTMLPARSER_BLOCK;
       }

content/xml/document/src/nsXMLContentSink.cpp

@@ -1675,10 +1675,6 @@ nsXMLContentSink::OnStreamComplete(nsIStreamLoader* aLoader,
   rv = ResumeParsing();
   if (NS_FAILED(rv)) return rv;
 
-  // We added a reference when the loader was created. This
-  // release should destroy it.
-  NS_RELEASE(aLoader);
-
   return rv;
 }
 
@@ -1754,11 +1750,12 @@ nsXMLContentSink::ProcessStartSCRIPTTag(const nsIParserNode& aNode)
       if (NS_FAILED(rv)) 
           return rv;
 
-      nsIStreamLoader* loader;
+      nsCOMPtr<nsIStreamLoader> loader;
       nsCOMPtr<nsILoadGroup> loadGroup;
 
       mDocument->GetDocumentLoadGroup(getter_AddRefs(loadGroup));
-      rv = NS_NewStreamLoader(&loader, url, this, nsnull, loadGroup);
+      rv = NS_NewStreamLoader(getter_AddRefs(loader), url, this, nsnull,
+                              loadGroup);
       NS_RELEASE(url);
       if (NS_OK == rv) {
         rv = NS_ERROR_HTMLPARSER_BLOCK;

layout/html/document/src/nsHTMLContentSink.cpp

@@ -4720,9 +4720,6 @@ HTMLContentSink::OnStreamComplete(nsIStreamLoader* aLoader,
   rv = ResumeParsing();
   if (NS_FAILED(rv)) return rv;
 
-  // We added a reference when the loader was created. This
-  // release should destroy it.
-  NS_RELEASE(aLoader);
   //invalidate Xfer buffer content
   mUnicodeXferBuf.SetLength(0); 
 
@@ -4915,7 +4912,7 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode)
       }
 
       nsCOMPtr<nsILoadGroup> loadGroup;
-      nsIStreamLoader* loader;
+      nsCOMPtr<nsIStreamLoader> loader;
 
       mDocument->GetDocumentLoadGroup(getter_AddRefs(loadGroup));
 
@@ -4923,8 +4920,9 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode)
       // from within this new stream loader to have proper parenting. but it's
       // not fatal if there isn't a prompter.
       nsCOMPtr<nsIInterfaceRequestor> promptcall(do_QueryInterface(mWebShell));
-      rv = NS_NewStreamLoader(&loader, mScriptURI, this, nsnull, loadGroup,
-                              promptcall, nsIChannel::FORCE_RELOAD);
+      rv = NS_NewStreamLoader(getter_AddRefs(loader), mScriptURI, this,
+                              nsnull, loadGroup, promptcall,
+                              nsIChannel::FORCE_RELOAD);
       if (NS_OK == rv) {
         rv = NS_ERROR_HTMLPARSER_BLOCK;
       }

layout/xml/document/src/nsXMLContentSink.cpp

@@ -1675,10 +1675,6 @@ nsXMLContentSink::OnStreamComplete(nsIStreamLoader* aLoader,
   rv = ResumeParsing();
   if (NS_FAILED(rv)) return rv;
 
-  // We added a reference when the loader was created. This
-  // release should destroy it.
-  NS_RELEASE(aLoader);
-
   return rv;
 }
 
@@ -1754,11 +1750,12 @@ nsXMLContentSink::ProcessStartSCRIPTTag(const nsIParserNode& aNode)
       if (NS_FAILED(rv)) 
           return rv;
 
-      nsIStreamLoader* loader;
+      nsCOMPtr<nsIStreamLoader> loader;
       nsCOMPtr<nsILoadGroup> loadGroup;
 
       mDocument->GetDocumentLoadGroup(getter_AddRefs(loadGroup));
-      rv = NS_NewStreamLoader(&loader, url, this, nsnull, loadGroup);
+      rv = NS_NewStreamLoader(getter_AddRefs(loader), url, this, nsnull,
+                              loadGroup);
       NS_RELEASE(url);
       if (NS_OK == rv) {
         rv = NS_ERROR_HTMLPARSER_BLOCK;

netwerk/base/src/nsAsyncStreamListener.cpp

@@ -298,7 +298,10 @@ nsOnStopRequestEvent::HandleEvent()
     if (NS_SUCCEEDED(rv) && NS_FAILED(status)) {
         mStatus = status;
     }
-    return receiver->OnStopRequest(mChannel, mContext, mStatus, mStatusArg.GetUnicode());
+    rv = receiver->OnStopRequest(mChannel, mContext, mStatus, mStatusArg.GetUnicode());
+    // Call clear on the listener to make sure it's cleanup is done on the correct thread
+    mListener->Clear();
+    return rv;
 }
 
 NS_IMETHODIMP 

netwerk/base/src/nsAsyncStreamListener.h

@@ -50,6 +50,7 @@ public:
     Create(nsISupports *aOuter, REFNSIID aIID, void **aResult);
 
     nsISupports* GetReceiver()      { return mReceiver.get(); }
+    void Clear()      { mReceiver = nsnull; }
 
 protected:
     nsCOMPtr<nsIEventQueue>     mEventQueue;