Bug 1006530 - Closing a audio RTSP streaming via tab page causes system crash. r=sworkman

netwerk/protocol/rtsp/controller/RtspController.cpp

@@ -188,9 +188,7 @@ RtspController::AsyncOpen(nsIStreamingProtocolListener *aListener)
     return NS_ERROR_NOT_INITIALIZED;
   }
 
-  // Use main thread pointer, but allow access off main thread.
-  mListener =
-    new nsMainThreadPtrHolder<nsIStreamingProtocolListener>(aListener, false);
+  mListener = aListener;
 
   if (!mURI) {
     LOG(("RtspController::AsyncOpen() illegal URI"));

netwerk/protocol/rtsp/controller/RtspController.h

@@ -37,7 +37,7 @@ private:
   // RTSP URL refer to a stream or an aggregate of streams.
   nsCOMPtr<nsIURI> mURI;
   // The nsIStreamingProtocolListener implementation.
-  nsMainThreadPtrHandle<nsIStreamingProtocolListener> mListener;
+  nsCOMPtr<nsIStreamingProtocolListener> mListener;
   // ASCII encoded URL spec.
   nsCString mSpec;
   // Indicate the connection state between the

netwerk/protocol/rtsp/controller/RtspControllerParent.cpp

@@ -7,6 +7,8 @@
 #include "RtspControllerParent.h"
 #include "RtspController.h"
 #include "nsIAuthPromptProvider.h"
+#include "nsThreadUtils.h"
+#include "nsProxyRelease.h"
 #include "mozilla/ipc/InputStreamUtils.h"
 #include "mozilla/ipc/URIUtils.h"
 #include "mozilla/unused.h"
@@ -31,9 +33,31 @@ using namespace mozilla::ipc;
 namespace mozilla {
 namespace net {
 
-NS_IMPL_ISUPPORTS(RtspControllerParent,
-                  nsIInterfaceRequestor,
-                  nsIStreamingProtocolListener)
+void
+RtspControllerParent::Destroy()
+{
+  // If we're being destroyed on a non-main thread, we AddRef again and use a
+  // proxy to release the RtspControllerParent on the main thread, where the
+  // RtspControllerParent is deleted. This ensures we only delete the
+  // RtspControllerParent on the main thread.
+  if (!NS_IsMainThread()) {
+    nsCOMPtr<nsIThread> mainThread = do_GetMainThread();
+    NS_ENSURE_TRUE_VOID(mainThread);
+    nsRefPtr<RtspControllerParent> doomed(this);
+    if (NS_FAILED(NS_ProxyRelease(mainThread,
+            static_cast<nsIStreamingProtocolListener*>(doomed), true))) {
+      NS_WARNING("Failed to proxy release to main thread!");
+    }
+  } else {
+    delete this;
+  }
+}
+
+NS_IMPL_ADDREF(RtspControllerParent)
+NS_IMPL_RELEASE_WITH_DESTROY(RtspControllerParent, Destroy())
+NS_IMPL_QUERY_INTERFACE(RtspControllerParent,
+                        nsIInterfaceRequestor,
+                        nsIStreamingProtocolListener)
 
 RtspControllerParent::RtspControllerParent()
   : mIPCOpen(true)

netwerk/protocol/rtsp/controller/RtspControllerParent.h

@@ -49,6 +49,8 @@ class RtspControllerParent : public PRtspControllerParent
   // The nsIStreamingProtocolController implementation.
   nsCOMPtr<nsIStreamingProtocolController> mController;
   uint32_t mTotalTracks;
+  // Ensure we are destroyed on the main thread.
+  void Destroy();
 };
 
 } // namespace net