Bug 1044443 - release off main thread crash in nsXPCWrappedJS::Release() via nsUpdateProcessor::~nsUpdateProcessor(). r=bbondy

Author: Robert Strong

toolkit/mozapps/update/nsUpdateService.js

@@ -3530,7 +3530,11 @@ UpdateManager.prototype = {
     }
   },
 
-  refreshUpdateStatus: function UM_refreshUpdateStatus(update) {
+  /**
+   * See nsIUpdateService.idl
+   */
+  refreshUpdateStatus: function UM_refreshUpdateStatus(aUpdate) {
+    var update = this._activeUpdate ? this._activeUpdate : aUpdate;
     var updateSucceeded = true;
     var status = readStatusFile(getUpdatesDir());
     var ary = status.split(":");

toolkit/xre/nsUpdateDriver.cpp

@@ -1170,8 +1170,6 @@ nsUpdateProcessor::ProcessUpdate(nsIUpdate* aUpdate)
   }
 #endif
 
-  mUpdate = aUpdate;
-
   MOZ_ASSERT(NS_IsMainThread(), "not main thread");
   return NS_NewThread(getter_AddRefs(mProcessWatcher),
                       NS_NewRunnableMethod(this, &nsUpdateProcessor::StartStagedUpdate));
@@ -1215,7 +1213,6 @@ nsUpdateProcessor::ShutdownWatcherThread()
   MOZ_ASSERT(NS_IsMainThread(), "not main thread");
   mProcessWatcher->Shutdown();
   mProcessWatcher = nullptr;
-  mUpdate = nullptr;
 }
 
 void
@@ -1233,8 +1230,12 @@ nsUpdateProcessor::UpdateDone()
 
   nsCOMPtr<nsIUpdateManager> um =
     do_GetService("@mozilla.org/updates/update-manager;1");
-  if (um && mUpdate) {
-    um->RefreshUpdateStatus(mUpdate);
+  if (um) {
+    nsCOMPtr<nsIUpdate> update;
+    um->GetActiveUpdate(getter_AddRefs(update));
+    if (update) {
+      um->RefreshUpdateStatus(update);
+    }
   }
 
   ShutdownWatcherThread();

toolkit/xre/nsUpdateDriver.h

@@ -105,7 +105,6 @@ class nsUpdateProcessor MOZ_FINAL : public nsIUpdateProcessor
 private:
   ProcessType mUpdaterPID;
   nsCOMPtr<nsIThread> mProcessWatcher;
-  nsCOMPtr<nsIUpdate> mUpdate;
   StagedUpdateInfo mInfo;
 };
 #endif