Bug 383553 - Crash on quit in nsTimerImpl::Release, r=dbaron sr=brendan

xpcom/threads/TimerThread.cpp

@@ -74,11 +74,7 @@ TimerThread::~TimerThread()
 
   mThread = nsnull;
 
-  PRInt32 n = mTimers.Count();
-  while (--n >= 0) {
-    nsTimerImpl *timer = static_cast<nsTimerImpl *>(mTimers[n]);
-    NS_RELEASE(timer);
-  }
+  NS_ASSERTION(mTimers.Count() == 0, "Timers remain in TimerThread::~TimerThread");
 }
 
 nsresult
@@ -332,7 +328,7 @@ nsresult TimerThread::AddTimer(nsTimerImpl *aTimer)
   // Add the timer to our list.
   PRInt32 i = AddTimerInternal(aTimer);
   if (i < 0)
-    return NS_ERROR_OUT_OF_MEMORY;
+    return NS_ERROR_FAILURE;
 
   // Awaken the timer thread.
   if (mCondVar && mWaiting && i == 0)
@@ -384,6 +380,9 @@ nsresult TimerThread::RemoveTimer(nsTimerImpl *aTimer)
 // This function must be called from within a lock
 PRInt32 TimerThread::AddTimerInternal(nsTimerImpl *aTimer)
 {
+  if (mShutdown)
+    return -1;
+
   PRIntervalTime now = PR_IntervalNow();
   PRInt32 count = mTimers.Count();
   PRInt32 i = 0;

xpcom/threads/nsTimerImpl.cpp

@@ -128,6 +128,7 @@ NS_IMETHODIMP_(nsrefcnt) nsTimerImpl::Release(void)
   if (count == 1 && mArmed) {
     mCanceled = PR_TRUE;
 
+    NS_ASSERTION(gThread, "An armed timer exists after the thread timer stopped.");
     if (NS_SUCCEEDED(gThread->RemoveTimer(this)))
       return 0;
   }