From 25b8e29ff29633fee0668e95a118703e0b658dab Mon Sep 17 00:00:00 2001 From: "jst%netscape.com" Date: Mon, 6 Nov 2000 23:22:44 +0000 Subject: [PATCH] Fixing bug 58888. The content sink was incorrectly releasing the stream loader in its OnStreamComplete() method, this caused a crash when mozilla was running in off-line mode since OnStreamComplete() was called without the sink having a string reference to the stream loader so the incorrect release call in the sink caused a crash later on in necko. sr=rpotts, r=gagan,heikki --- content/html/document/src/nsHTMLContentSink.cpp | 10 ++++------ content/xml/document/src/nsXMLContentSink.cpp | 9 +++------ layout/html/document/src/nsHTMLContentSink.cpp | 10 ++++------ layout/xml/document/src/nsXMLContentSink.cpp | 9 +++------ netwerk/base/src/nsAsyncStreamListener.cpp | 5 ++++- netwerk/base/src/nsAsyncStreamListener.h | 1 + 6 files changed, 19 insertions(+), 25 deletions(-) diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp index bb71c69854a1..a67e6dfcdb26 100644 --- a/content/html/document/src/nsHTMLContentSink.cpp +++ b/content/html/document/src/nsHTMLContentSink.cpp @@ -4720,9 +4720,6 @@ HTMLContentSink::OnStreamComplete(nsIStreamLoader* aLoader, rv = ResumeParsing(); if (NS_FAILED(rv)) return rv; - // We added a reference when the loader was created. This - // release should destroy it. - NS_RELEASE(aLoader); //invalidate Xfer buffer content mUnicodeXferBuf.SetLength(0); @@ -4915,7 +4912,7 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode) } nsCOMPtr loadGroup; - nsIStreamLoader* loader; + nsCOMPtr loader; mDocument->GetDocumentLoadGroup(getter_AddRefs(loadGroup)); @@ -4923,8 +4920,9 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode) // from within this new stream loader to have proper parenting. but it's // not fatal if there isn't a prompter. nsCOMPtr promptcall(do_QueryInterface(mWebShell)); - rv = NS_NewStreamLoader(&loader, mScriptURI, this, nsnull, loadGroup, - promptcall, nsIChannel::FORCE_RELOAD); + rv = NS_NewStreamLoader(getter_AddRefs(loader), mScriptURI, this, + nsnull, loadGroup, promptcall, + nsIChannel::FORCE_RELOAD); if (NS_OK == rv) { rv = NS_ERROR_HTMLPARSER_BLOCK; } diff --git a/content/xml/document/src/nsXMLContentSink.cpp b/content/xml/document/src/nsXMLContentSink.cpp index f342509d8987..993bf37325bd 100644 --- a/content/xml/document/src/nsXMLContentSink.cpp +++ b/content/xml/document/src/nsXMLContentSink.cpp @@ -1675,10 +1675,6 @@ nsXMLContentSink::OnStreamComplete(nsIStreamLoader* aLoader, rv = ResumeParsing(); if (NS_FAILED(rv)) return rv; - // We added a reference when the loader was created. This - // release should destroy it. - NS_RELEASE(aLoader); - return rv; } @@ -1754,11 +1750,12 @@ nsXMLContentSink::ProcessStartSCRIPTTag(const nsIParserNode& aNode) if (NS_FAILED(rv)) return rv; - nsIStreamLoader* loader; + nsCOMPtr loader; nsCOMPtr loadGroup; mDocument->GetDocumentLoadGroup(getter_AddRefs(loadGroup)); - rv = NS_NewStreamLoader(&loader, url, this, nsnull, loadGroup); + rv = NS_NewStreamLoader(getter_AddRefs(loader), url, this, nsnull, + loadGroup); NS_RELEASE(url); if (NS_OK == rv) { rv = NS_ERROR_HTMLPARSER_BLOCK; diff --git a/layout/html/document/src/nsHTMLContentSink.cpp b/layout/html/document/src/nsHTMLContentSink.cpp index bb71c69854a1..a67e6dfcdb26 100644 --- a/layout/html/document/src/nsHTMLContentSink.cpp +++ b/layout/html/document/src/nsHTMLContentSink.cpp @@ -4720,9 +4720,6 @@ HTMLContentSink::OnStreamComplete(nsIStreamLoader* aLoader, rv = ResumeParsing(); if (NS_FAILED(rv)) return rv; - // We added a reference when the loader was created. This - // release should destroy it. - NS_RELEASE(aLoader); //invalidate Xfer buffer content mUnicodeXferBuf.SetLength(0); @@ -4915,7 +4912,7 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode) } nsCOMPtr loadGroup; - nsIStreamLoader* loader; + nsCOMPtr loader; mDocument->GetDocumentLoadGroup(getter_AddRefs(loadGroup)); @@ -4923,8 +4920,9 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode) // from within this new stream loader to have proper parenting. but it's // not fatal if there isn't a prompter. nsCOMPtr promptcall(do_QueryInterface(mWebShell)); - rv = NS_NewStreamLoader(&loader, mScriptURI, this, nsnull, loadGroup, - promptcall, nsIChannel::FORCE_RELOAD); + rv = NS_NewStreamLoader(getter_AddRefs(loader), mScriptURI, this, + nsnull, loadGroup, promptcall, + nsIChannel::FORCE_RELOAD); if (NS_OK == rv) { rv = NS_ERROR_HTMLPARSER_BLOCK; } diff --git a/layout/xml/document/src/nsXMLContentSink.cpp b/layout/xml/document/src/nsXMLContentSink.cpp index f342509d8987..993bf37325bd 100644 --- a/layout/xml/document/src/nsXMLContentSink.cpp +++ b/layout/xml/document/src/nsXMLContentSink.cpp @@ -1675,10 +1675,6 @@ nsXMLContentSink::OnStreamComplete(nsIStreamLoader* aLoader, rv = ResumeParsing(); if (NS_FAILED(rv)) return rv; - // We added a reference when the loader was created. This - // release should destroy it. - NS_RELEASE(aLoader); - return rv; } @@ -1754,11 +1750,12 @@ nsXMLContentSink::ProcessStartSCRIPTTag(const nsIParserNode& aNode) if (NS_FAILED(rv)) return rv; - nsIStreamLoader* loader; + nsCOMPtr loader; nsCOMPtr loadGroup; mDocument->GetDocumentLoadGroup(getter_AddRefs(loadGroup)); - rv = NS_NewStreamLoader(&loader, url, this, nsnull, loadGroup); + rv = NS_NewStreamLoader(getter_AddRefs(loader), url, this, nsnull, + loadGroup); NS_RELEASE(url); if (NS_OK == rv) { rv = NS_ERROR_HTMLPARSER_BLOCK; diff --git a/netwerk/base/src/nsAsyncStreamListener.cpp b/netwerk/base/src/nsAsyncStreamListener.cpp index 22aa4daea426..342ab4cf9f70 100644 --- a/netwerk/base/src/nsAsyncStreamListener.cpp +++ b/netwerk/base/src/nsAsyncStreamListener.cpp @@ -298,7 +298,10 @@ nsOnStopRequestEvent::HandleEvent() if (NS_SUCCEEDED(rv) && NS_FAILED(status)) { mStatus = status; } - return receiver->OnStopRequest(mChannel, mContext, mStatus, mStatusArg.GetUnicode()); + rv = receiver->OnStopRequest(mChannel, mContext, mStatus, mStatusArg.GetUnicode()); + // Call clear on the listener to make sure it's cleanup is done on the correct thread + mListener->Clear(); + return rv; } NS_IMETHODIMP diff --git a/netwerk/base/src/nsAsyncStreamListener.h b/netwerk/base/src/nsAsyncStreamListener.h index 1bc49738e3de..7eac3aa63554 100644 --- a/netwerk/base/src/nsAsyncStreamListener.h +++ b/netwerk/base/src/nsAsyncStreamListener.h @@ -50,6 +50,7 @@ public: Create(nsISupports *aOuter, REFNSIID aIID, void **aResult); nsISupports* GetReceiver() { return mReceiver.get(); } + void Clear() { mReceiver = nsnull; } protected: nsCOMPtr mEventQueue;