From 369c3dbf2e08ed6096d4559300b784b7b0c81f82 Mon Sep 17 00:00:00 2001
From: "dveditz%cruzio.com" <dveditz%cruzio.com>
Date: Fri, 26 Jan 2007 02:50:18 +0000
Subject: [PATCH] coverity-found potential use-after-free in testcases (bug
 334541). r=bsmedberg

---
 xpcom/tests/TestCOMPtr.cpp     | 15 ++++++---------
 xpcom/tests/TestHashtables.cpp | 15 ++++++---------
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/xpcom/tests/TestCOMPtr.cpp b/xpcom/tests/TestCOMPtr.cpp
index fb0267cb758a..8626c06dbee8 100644
--- a/xpcom/tests/TestCOMPtr.cpp
+++ b/xpcom/tests/TestCOMPtr.cpp
@@ -155,24 +155,21 @@ IFoo::AddRef()
 nsrefcnt
 IFoo::Release()
   {
-    int wrap_message = (refcount_ == 1);
-    if ( wrap_message )
+    int newcount = --refcount_;
+    if ( newcount == 0 )
       printf(">>");
-      
-    --refcount_;
+
     printf("IFoo@%p::Release(), refcount --> %d\n",
            STATIC_CAST(void*, this), refcount_);
 
-    if ( !refcount_ )
+    if ( newcount == 0 )
       {
         printf("  delete IFoo@%p\n", STATIC_CAST(void*, this));
+        printf("<<IFoo@%p::Release()\n", STATIC_CAST(void*, this));
         delete this;
       }
 
-    if ( wrap_message )
-      printf("<<IFoo@%p::Release()\n", STATIC_CAST(void*, this));
-
-    return refcount_;
+    return newcount;
   }
 
 nsresult
diff --git a/xpcom/tests/TestHashtables.cpp b/xpcom/tests/TestHashtables.cpp
index 92b2872b07ea..6ad7ce25b530 100644
--- a/xpcom/tests/TestHashtables.cpp
+++ b/xpcom/tests/TestHashtables.cpp
@@ -288,24 +288,21 @@ IFoo::AddRef()
 nsrefcnt
 IFoo::Release()
   {
-    int wrap_message = (refcount_ == 1);
-    if ( wrap_message )
+    int newcount = --refcount_;
+    if ( newcount == 0 )
       printf(">>");
-      
-    --refcount_;
+
     printf("IFoo@%p::Release(), refcount --> %d\n",
            NS_STATIC_CAST(void*, this), refcount_);
 
-    if ( !refcount_ )
+    if ( newcount == 0 )
       {
         printf("  delete IFoo@%p\n", NS_STATIC_CAST(void*, this));
+        printf("<<IFoo@%p::Release()\n", NS_STATIC_CAST(void*, this));
         delete this;
       }
 
-    if ( wrap_message )
-      printf("  delete IFoo@%p\n", NS_STATIC_CAST(void*, this));
-
-    return refcount_;
+    return newcount;
   }
 
 nsresult