From ff51038cee53ce70c69c9e3fe1232c98ff3f8c97 Mon Sep 17 00:00:00 2001
From: "benjamin@smedbergs.us" <benjamin@smedbergs.us>
Date: Thu, 9 Aug 2007 11:37:02 -0700
Subject: [PATCH] Bug 383553 - Crash on quit in nsTimerImpl::Release, r=dbaron
 sr=brendan

---
 xpcom/threads/TimerThread.cpp | 11 +++++------
 xpcom/threads/nsTimerImpl.cpp |  1 +
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/xpcom/threads/TimerThread.cpp b/xpcom/threads/TimerThread.cpp
index 70ee4b32872..4e90a5a7280 100644
--- a/xpcom/threads/TimerThread.cpp
+++ b/xpcom/threads/TimerThread.cpp
@@ -74,11 +74,7 @@ TimerThread::~TimerThread()
 
   mThread = nsnull;
 
-  PRInt32 n = mTimers.Count();
-  while (--n >= 0) {
-    nsTimerImpl *timer = static_cast<nsTimerImpl *>(mTimers[n]);
-    NS_RELEASE(timer);
-  }
+  NS_ASSERTION(mTimers.Count() == 0, "Timers remain in TimerThread::~TimerThread");
 }
 
 nsresult
@@ -332,7 +328,7 @@ nsresult TimerThread::AddTimer(nsTimerImpl *aTimer)
   // Add the timer to our list.
   PRInt32 i = AddTimerInternal(aTimer);
   if (i < 0)
-    return NS_ERROR_OUT_OF_MEMORY;
+    return NS_ERROR_FAILURE;
 
   // Awaken the timer thread.
   if (mCondVar && mWaiting && i == 0)
@@ -384,6 +380,9 @@ nsresult TimerThread::RemoveTimer(nsTimerImpl *aTimer)
 // This function must be called from within a lock
 PRInt32 TimerThread::AddTimerInternal(nsTimerImpl *aTimer)
 {
+  if (mShutdown)
+    return -1;
+
   PRIntervalTime now = PR_IntervalNow();
   PRInt32 count = mTimers.Count();
   PRInt32 i = 0;
diff --git a/xpcom/threads/nsTimerImpl.cpp b/xpcom/threads/nsTimerImpl.cpp
index de92b2ab076..828a2925fa1 100644
--- a/xpcom/threads/nsTimerImpl.cpp
+++ b/xpcom/threads/nsTimerImpl.cpp
@@ -128,6 +128,7 @@ NS_IMETHODIMP_(nsrefcnt) nsTimerImpl::Release(void)
   if (count == 1 && mArmed) {
     mCanceled = PR_TRUE;
 
+    NS_ASSERTION(gThread, "An armed timer exists after the thread timer stopped.");
     if (NS_SUCCEEDED(gThread->RemoveTimer(this)))
       return 0;
   }