Bug 337492 - Fix destructor race condition in proxy events, initial patch by Alex Fritze, with additional comments by me, r=me+dbaron

xpcom/proxy/src/nsProxyEventObject.cpp

@@ -57,9 +57,9 @@ nsProxyEventObject::nsProxyEventObject(nsProxyObject *aParent,
                             nsProxyEventClass* aClass,
                             already_AddRefed<nsISomeInterface> aRealInterface,
                             nsresult *rv)
-    : mRealInterface(aRealInterface),
-      mClass(aClass),
+    : mClass(aClass),
       mProxyObject(aParent),
+      mRealInterface(aRealInterface),
       mNext(nsnull)
 {
     *rv = InitStub(aClass->GetProxiedIID());
@@ -71,6 +71,11 @@ nsProxyEventObject::~nsProxyEventObject()
     // XXX assert this!
 
     mProxyObject->LockedRemove(this);
+
+    // mRealInterface must be released before mProxyObject so that the last
+    // release of the proxied object is proxied to the correct thread.
+    // See bug 337492.
+    mRealInterface = nsnull;
 }
 
 //

xpcom/proxy/src/nsProxyEventPrivate.h

@@ -181,9 +181,10 @@ public:
 private:
     ~nsProxyEventObject();
 
-    nsCOMPtr<nsISomeInterface>  mRealInterface;
+    // Member ordering is important: See note in the destructor.
     nsProxyEventClass          *mClass;
     nsCOMPtr<nsProxyObject>     mProxyObject;
+    nsCOMPtr<nsISomeInterface>  mRealInterface;
 
     // Weak reference, maintained by the parent nsProxyObject
     nsProxyEventObject         *mNext;