There are multiple defects in NetworkWorker and the related parts
since the C++ rewrite. 1) NetworkService holds a reference to
NetworkWorker and never releases it. It has to wait until the cycle
collector comes up to resolve their ownership loop and free
NetworkWorker manually. However 2) nsINetworkWorker::shutdown is
never called, and that leaves everything living till the end,
inclusive of that gNetdConsumer in Netd.cpp. 3) when GC comes to free
NetworkWorker, it calls its parent destructor ~NetConsumer(), which
in turn calls ~RefCounted<NetdConsumer>(). Having a valid
gNetdConsumer in Netd.cpp follows its refCnt is not zero and this
triggers an assertion in ~RefCounted<NetdConsumer>().
So, some obvious treatments here. A) NetworkService should call
nsINetworkWorker::shutdown upon receiving a shutdown observer event
and release the reference to NetworkWorker. B) NetworkWorker should
never be double ref-counted. Move NetdConsumer implementation into a
separated class.
Ehsan Akhgari
Vicamo Yang
John Shih
Dimi Lee