Fix for topcrashers bug 143118 and bug 146891 - prevent continued deserialization after a a deserialization failure of the XUL PD by aborting on failure, also, ensure that that propagates up so we can catch it. Fix an oops (trying to remove the fasl file before closing the stream to it) and hack around a nsLocalFileWin bug (bug 150156) in the process. r=waterson, sr=brendan, a=asa

content/xul/content/src/nsXULElement.cpp

@@ -5040,6 +5040,7 @@ nsXULPrototypeElement::Deserialize(nsIObjectInputStream* aStream,
     
     if (mNumChildren > 0) {
         mChildren = new nsXULPrototypeNode*[mNumChildren];
+        memset(mChildren, 0, sizeof(nsXULPrototypeNode*) * mNumChildren);
         if (! mChildren)
             return NS_ERROR_OUT_OF_MEMORY;
 
@@ -5090,6 +5091,16 @@ nsXULPrototypeElement::Deserialize(nsIObjectInputStream* aStream,
             }
 
             mChildren[i] = child;
+
+            // Oh dear. Something failed during the deserialization. We don't know what. 
+            // But likely consequences of failed deserializations included calls to 
+            // |AbortFastLoads| which shuts down the FastLoadService and closes our 
+            // streams. If that happens, next time through this loop, we die a messy
+            // death. So, let's just fail now, and propagate that failure upward so that
+            // the ChromeProtocolHandler knows it can't use a cached chrome channel for 
+            // this. 
+            if (NS_FAILED(rv))
+                return rv;
         }
     }
 
@@ -5287,6 +5298,10 @@ nsresult
 nsXULPrototypeScript::DeserializeOutOfLineScript(nsIObjectInputStream* aInput,
                                                  nsIScriptContext* aContext)
 {
+    // Keep track of FastLoad failure via rv, so we can
+    // AbortFastLoads if things look bad.
+    nsresult rv = NS_OK;
+
     nsIXULPrototypeCache* cache = GetXULCache();
     nsCOMPtr<nsIFastLoadService> fastLoadService;
     cache->GetFastLoadService(getter_AddRefs(fastLoadService));
@@ -5316,10 +5331,6 @@ nsXULPrototypeScript::DeserializeOutOfLineScript(nsIObjectInputStream* aInput,
         }
 
         if (! mJSObject) {
-            // Keep track of FastLoad failure via rv, so we can
-            // AbortFastLoads if things look bad.
-            nsresult rv = NS_OK;
-
             nsCOMPtr<nsIURI> oldURI;
 
             if (mSrcURI) {
@@ -5380,7 +5391,7 @@ nsXULPrototypeScript::DeserializeOutOfLineScript(nsIObjectInputStream* aInput,
         }
     }
 
-    return NS_OK;
+    return rv;
 }
 
 nsresult

content/xul/content/src/nsXULElement.h

@@ -246,8 +246,11 @@ public:
     virtual void ReleaseSubtree() 
     {
       if (mChildren) {
-        for (PRInt32 i = mNumChildren-1; i >= 0; i--)
+        for (PRInt32 i = mNumChildren-1; i >= 0; i--) {
+          if (! mChildren[i])
+            break;
           mChildren[i]->ReleaseSubtree();
+        }
       }
 
       nsXULPrototypeNode::ReleaseSubtree();

content/xul/document/src/nsXULPrototypeCache.cpp

@@ -73,7 +73,6 @@
 #include "nsNetUtil.h"
 #include "nsAppDirectoryServiceDefs.h"
 
-
 class nsXULPrototypeCache : public nsIXULPrototypeCache
 {
 public:
@@ -274,12 +273,11 @@ nsXULPrototypeCache::GetPrototype(nsIURI* aURI, nsIXULPrototypeDocument** _resul
                 if (NS_SUCCEEDED(rv)) {
                     NS_ADDREF(*_result = protoDoc);
                     PutPrototype(protoDoc);
+
+                    gFastLoadService->EndMuxedDocument(aURI);
                 }
 
-                gFastLoadService->EndMuxedDocument(aURI);
-
                 RemoveFromFastLoadSet(aURI);
-
             }
         }
     }
@@ -564,15 +562,6 @@ nsXULPrototypeCache::AbortFastLoads()
     // close open streams to it.
     nsCOMPtr<nsIFile> file = gFastLoadFile;
 
-    // Now rename or remove the file.
-    if (file) {
-#ifdef DEBUG
-        file->MoveToNative(nsnull, NS_LITERAL_CSTRING("Aborted.mfasl"));
-#else
-        file->Remove(PR_FALSE);
-#endif
-    }
-
     // Flush the XUL cache for good measure, in case we cached a bogus/downrev
     // script, somehow.
     Flush();
@@ -606,6 +595,25 @@ nsXULPrototypeCache::AbortFastLoads()
         objectInput->Close();
     }
 
+    // Now rename or remove the file.
+    if (file) {
+#ifdef DEBUG
+        // Remove any existing Aborted.mfasl files generated in previous runs. 
+        nsCOMPtr<nsIFile> existingAbortedFile;
+        file->Clone(getter_AddRefs(existingAbortedFile));
+        if (existingAbortedFile) {
+            existingAbortedFile->SetLeafName(NS_LITERAL_STRING("Aborted.mfasl"));
+            PRBool fileExists = PR_FALSE;
+            existingAbortedFile->Exists(&fileExists);
+            if (fileExists)
+                existingAbortedFile->Remove(PR_FALSE);
+        }
+        file->MoveToNative(nsnull, NS_LITERAL_CSTRING("Aborted.mfasl"));
+#else
+        file->Remove(PR_FALSE);
+#endif
+    }
+
     // If the list is empty now, the FastLoad process is done.
     NS_RELEASE(gFastLoadService);
     NS_RELEASE(gFastLoadFile);
@@ -866,6 +874,7 @@ nsXULPrototypeCache::StartFastLoad(nsIURI* aURI)
         prefs->RegisterCallback(kChecksumXULFastLoadFilePref,
                                 FastLoadPrefChangedCallback,
                                 nsnull);
+
         if (gDisableXULFastLoad)
             return NS_ERROR_NOT_AVAILABLE;
     }
@@ -1015,4 +1024,3 @@ nsXULPrototypeCache::StartFastLoad(nsIURI* aURI)
     return NS_OK;
 }
 
-