Fixing crash introduced with my earlier changes for bug 294893. Make nw and wn finalizers order independent. r+sr=bzbarsky@mit.edu, a=drivers

js/src/xpconnect/src/XPCNativeWrapper.cpp

@@ -720,12 +720,11 @@ XPC_NW_Convert(JSContext *cx, JSObject *obj, JSType type, jsval *vp)
 JS_STATIC_DLL_CALLBACK(void)
 XPC_NW_Finalize(JSContext *cx, JSObject *obj)
 {
-  XPCWrappedNative *wrappedNative =
-    XPCNativeWrapper::GetWrappedNative(cx, obj);
-
-  if (wrappedNative) {
-    XPCJSRuntime *rt = wrappedNative->GetRuntime();
+  // We must not use obj's private data here since it's likely that it
+  // has already been finalized.
+  XPCJSRuntime *rt = nsXPConnect::GetRuntime();
 
+  {
     // scoped lock
     XPCAutoLock lock(rt->GetMapLock());
     rt->GetExplicitNativeWrapperMap()->Remove(obj);

js/src/xpconnect/src/XPCNativeWrapper.h

@@ -58,12 +58,6 @@ public:
     return JS_GET_CLASS(cx, obj) == &sXPC_NW_JSClass.base;
   }
 
-  static void Invalidate(JSContext *cx, JSObject *obj)
-  {
-    // Remove the reference to our native wrapper
-    ::JS_SetPrivate(cx, obj, nsnull);
-  }
-
   static XPCWrappedNative *GetWrappedNative(JSContext *cx, JSObject *obj)
   {
     return (XPCWrappedNative *)::JS_GetPrivate(cx, obj);

js/src/xpconnect/src/xpcwrappednative.cpp

@@ -928,11 +928,8 @@ XPCWrappedNative::FlatJSObjectFinalized(JSContext *cx, JSObject *obj)
     NS_ASSERTION(*(int*)mIdentity != 0,          "bad pointer!");
 #endif
 
-    if (mNativeWrapper) {
-        // Invalidate our native wrapper (so that it
-        // doesn't try to access this wrapped native after it's gone).
-        XPCNativeWrapper::Invalidate(cx, mNativeWrapper);
-    }
+    // Note that it's not safe to touch mNativeWrapper here since it's
+    // likely that it has already been finalized.
 
     Release();
 }