Bug 1742334 - Make sure to null out ChannelEventQueue::mOwner when object is released r=necko-reviewers,dragana

Differential Revision: https://phabricator.services.mozilla.com/D131896

netwerk/ipc/ChannelEventQueue.cpp

@@ -34,7 +34,11 @@ void ChannelEventQueue::FlushQueue() {
   // Events flushed could include destruction of channel (and our own
   // destructor) unless we make sure its refcount doesn't drop to 0 while this
   // method is running.
-  nsCOMPtr<nsISupports> kungFuDeathGrip(mOwner);
+  nsCOMPtr<nsISupports> kungFuDeathGrip;
+  {
+    MutexAutoLock lock(mMutex);
+    kungFuDeathGrip = mOwner;
+  }
   mozilla::Unused << kungFuDeathGrip;  // Not used in this function
 
 #ifdef DEBUG
@@ -156,6 +160,10 @@ void ChannelEventQueue::ResumeInternal() {
       nsCOMPtr<nsISupports> mOwner;
     };
 
+    if (!mOwner) {
+      return;
+    }
+
     // Worker thread requires a CancelableRunnable.
     RefPtr<Runnable> event = new CompleteResumeRunnable(this, mOwner);
 

netwerk/ipc/ChannelEventQueue.h

@@ -147,6 +147,11 @@ class ChannelEventQueue final {
   // dispatched in a new event on the current thread.
   void Resume();
 
+  void NotifyReleasingOwner() {
+    MutexAutoLock lock(mMutex);
+    mOwner = nullptr;
+  }
+
 #ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
   bool IsEmpty() const { return mEventQueue.IsEmpty(); }
 #endif

netwerk/protocol/http/HttpChannelChild.cpp

@@ -141,6 +141,8 @@ HttpChannelChild::~HttpChannelChild() {
   }
 #endif
 
+  mEventQ->NotifyReleasingOwner();
+
   ReleaseMainThreadOnlyReferences();
 }
 

netwerk/protocol/http/HttpChannelParent.cpp

@@ -107,6 +107,7 @@ HttpChannelParent::~HttpChannelParent() {
     mRedirectCallback->OnRedirectVerifyCallback(NS_ERROR_UNEXPECTED);
     mRedirectCallback = nullptr;
   }
+  mEventQ->NotifyReleasingOwner();
 }
 
 void HttpChannelParent::ActorDestroy(ActorDestroyReason why) {

netwerk/protocol/http/HttpTransactionParent.cpp

@@ -84,6 +84,7 @@ HttpTransactionParent::HttpTransactionParent(bool aIsDocumentLoad)
 
 HttpTransactionParent::~HttpTransactionParent() {
   LOG(("Destroying HttpTransactionParent @%p\n", this));
+  mEventQ->NotifyReleasingOwner();
 }
 
 //-----------------------------------------------------------------------------

netwerk/protocol/websocket/WebSocketChannelChild.cpp

@@ -66,6 +66,7 @@ WebSocketChannelChild::WebSocketChannelChild(bool aEncrypted)
 
 WebSocketChannelChild::~WebSocketChannelChild() {
   LOG(("WebSocketChannelChild::~WebSocketChannelChild() %p\n", this));
+  mEventQ->NotifyReleasingOwner();
 }
 
 void WebSocketChannelChild::AddIPDLReference() {

toolkit/components/extensions/webrequest/StreamFilterParent.cpp

@@ -108,6 +108,7 @@ StreamFilterParent::~StreamFilterParent() {
   NS_ReleaseOnMainThread("StreamFilterParent::mOrigListener",
                          mOrigListener.forget());
   NS_ReleaseOnMainThread("StreamFilterParent::mContext", mContext.forget());
+  mQueue->NotifyReleasingOwner();
 }
 
 auto StreamFilterParent::Create(dom::ContentParent* aContentParent,