fix bug 100260. xpconnect should not hold a weak reference to a class…

…info object after the xpcwrappednativeproto that was holding a strong ref is destroyed. sr=jst, r=dbradley,markh.
dothq · Sep 19, 2001 · 229409f · 229409f
1 parent 06006e4
commit 229409f
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 0 deletions.
diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
@@ -1197,6 +1197,8 @@ class XPCNativeSet
                                       XPCNativeInterface* newInterface,
                                       PRUint16 position);
 
+    static void ClearCacheEntryForClassInfo(nsIClassInfo* classInfo);
+
     inline JSBool FindMember(jsval name, XPCNativeMember** pMember,
                              PRUint16* pInterfaceIndex) const;
 

diff --git a/js/src/xpconnect/src/xpcwrappednativeinfo.cpp b/js/src/xpconnect/src/xpcwrappednativeinfo.cpp
@@ -666,6 +666,21 @@ XPCNativeSet::GetNewOrUsed(XPCCallContext& ccx, nsIClassInfo* classInfo)
     return set;
 }
 
+// static 
+void 
+XPCNativeSet::ClearCacheEntryForClassInfo(nsIClassInfo* classInfo)
+{
+    XPCJSRuntime* rt;
+    ClassInfo2NativeSetMap* map;
+
+    if(nsnull != (rt = nsXPConnect::GetRuntime()) && 
+       nsnull != (map = rt->GetClassInfo2NativeSetMap()))
+    {   // scoped lock
+        XPCAutoLock lock(rt->GetMapLock());
+        map->Remove(classInfo);
+    }
+}
+
 // static
 XPCNativeSet*
 XPCNativeSet::GetNewOrUsed(XPCCallContext& ccx,

diff --git a/js/src/xpconnect/src/xpcwrappednativeproto.cpp b/js/src/xpconnect/src/xpcwrappednativeproto.cpp
@@ -74,6 +74,10 @@ XPCWrappedNativeProto::~XPCWrappedNativeProto()
 #ifdef DEBUG
     PR_AtomicDecrement(&gDEBUG_LiveProtoCount);
 #endif
+
+    // Note that our weak ref to mScope is not to be trusted at this point.
+
+    XPCNativeSet::ClearCacheEntryForClassInfo(mClassInfo);
 
     delete mScriptableInfo;
 }