Back out changeset ddda87bd4a4a (bug 765936) because of crashes. a=ba…

…ckout
mozilla · Jul 16, 2012 · 5d1a7c0 · 5d1a7c0
1 parent 25d7e45
commit 5d1a7c0
Show file tree

Hide file tree

Showing 4 changed files with 67 additions and 5 deletions.
diff --git a/dom/indexedDB/IDBFactory.cpp b/dom/indexedDB/IDBFactory.cpp
@@ -18,7 +18,6 @@
 #include "nsCharSeparatedTokenizer.h"
 #include "nsContentUtils.h"
 #include "nsDOMClassInfoID.h"
-#include "nsGlobalWindow.h"
 #include "nsHashKeys.h"
 #include "nsPIDOMWindow.h"
 #include "nsServiceManagerUtils.h"
@@ -440,8 +439,6 @@ IDBFactory::OpenCommon(const nsAString& aName,
 
   if (mWindow) {
     window = mWindow;
-    scriptOwner =
-      static_cast<nsGlobalWindow*>(window.get())->FastGetGlobalJSObject();
   }
   else {
     scriptOwner = mOwningObject;

diff --git a/dom/indexedDB/IDBRequest.cpp b/dom/indexedDB/IDBRequest.cpp
@@ -30,14 +30,17 @@ IDBRequest::IDBRequest()
 : mResultVal(JSVAL_VOID),
   mActorParent(nsnull),
   mErrorCode(NS_OK),
-  mHaveResultOrErrorCode(false)
+  mHaveResultOrErrorCode(false),
+  mRooted(false)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
 }
 
 IDBRequest::~IDBRequest()
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
+
+  UnrootResultVal();
 }
 
 // static
@@ -66,13 +69,15 @@ IDBRequest::Reset()
   mResultVal = JSVAL_VOID;
   mHaveResultOrErrorCode = false;
   mError = nsnull;
+  UnrootResultVal();
 }
 
 nsresult
 IDBRequest::NotifyHelperCompleted(HelperBase* aHelper)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
   NS_ASSERTION(!mHaveResultOrErrorCode, "Already called!");
+  NS_ASSERTION(!PreservingWrapper(), "Already rooted?!");
   NS_ASSERTION(JSVAL_IS_VOID(mResultVal), "Should be undefined!");
 
   // See if our window is still valid. If not then we're going to pretend that
@@ -106,6 +111,8 @@ IDBRequest::NotifyHelperCompleted(HelperBase* aHelper)
   JSAutoRequest ar(cx);
   JSAutoEnterCompartment ac;
   if (ac.enter(cx, global)) {
+    RootResultVal();
+
     rv = aHelper->GetSuccessResult(cx, &mResultVal);
     if (NS_FAILED(rv)) {
       NS_WARNING("GetSuccessResult failed!");
@@ -132,6 +139,7 @@ IDBRequest::NotifyHelperSentResultsToChildProcess(nsresult aRv)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
   NS_ASSERTION(!mHaveResultOrErrorCode, "Already called!");
+  NS_ASSERTION(!PreservingWrapper(), "Already rooted?!");
   NS_ASSERTION(JSVAL_IS_VOID(mResultVal), "Should be undefined!");
 
   // See if our window is still valid. If not then we're going to pretend that
@@ -158,6 +166,7 @@ IDBRequest::SetError(nsresult aRv)
   mErrorCode = aRv;
 
   mResultVal = JSVAL_VOID;
+  UnrootResultVal();
 }
 
 #ifdef DEBUG
@@ -198,6 +207,18 @@ IDBRequest::GetJSContext()
   return cx;
 }
 
+void
+IDBRequest::RootResultValInternal()
+{
+  NS_HOLD_JS_OBJECTS(this, IDBRequest);
+}
+
+void
+IDBRequest::UnrootResultValInternal()
+{
+  NS_DROP_JS_OBJECTS(this, IDBRequest);
+}
+
 NS_IMETHODIMP
 IDBRequest::GetReadyState(nsAString& aReadyState)
 {
@@ -275,6 +296,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(IDBRequest, IDBWrapperCache)
   tmp->mResultVal = JSVAL_VOID;
+  tmp->UnrootResultVal();
   NS_CYCLE_COLLECTION_UNLINK_EVENT_HANDLER(success)
   NS_CYCLE_COLLECTION_UNLINK_EVENT_HANDLER(error)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mSource)
@@ -316,6 +338,8 @@ IDBRequest::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
 IDBOpenDBRequest::~IDBOpenDBRequest()
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
+
+  UnrootResultVal();
 }
 
 // static
@@ -345,6 +369,18 @@ IDBOpenDBRequest::SetTransaction(IDBTransaction* aTransaction)
   mTransaction = aTransaction;
 }
 
+void
+IDBOpenDBRequest::RootResultValInternal()
+{
+  NS_HOLD_JS_OBJECTS(this, IDBOpenDBRequest);
+}
+
+void
+IDBOpenDBRequest::UnrootResultValInternal()
+{
+  NS_DROP_JS_OBJECTS(this, IDBOpenDBRequest);
+}
+
 NS_IMPL_CYCLE_COLLECTION_CLASS(IDBOpenDBRequest)
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(IDBOpenDBRequest,

diff --git a/dom/indexedDB/IDBRequest.h b/dom/indexedDB/IDBRequest.h
@@ -82,6 +82,25 @@ class IDBRequest : public IDBWrapperCache,
   IDBRequest();
   ~IDBRequest();
 
+  virtual void RootResultValInternal();
+  virtual void UnrootResultValInternal();
+
+  void RootResultVal()
+  {
+    if (!mRooted) {
+      RootResultValInternal();
+      mRooted = true;
+    }
+  }
+
+  void UnrootResultVal()
+  {
+    if (mRooted) {
+      UnrootResultValInternal();
+      mRooted = false;
+    }
+  }
+
   nsCOMPtr<nsISupports> mSource;
   nsRefPtr<IDBTransaction> mTransaction;
 
@@ -96,6 +115,7 @@ class IDBRequest : public IDBWrapperCache,
 
   nsresult mErrorCode;
   bool mHaveResultOrErrorCode;
+  bool mRooted;
 };
 
 class IDBOpenDBRequest : public IDBRequest,
@@ -128,6 +148,9 @@ class IDBOpenDBRequest : public IDBRequest,
 protected:
   ~IDBOpenDBRequest();
 
+  virtual void RootResultValInternal();
+  virtual void UnrootResultValInternal();
+
   // Only touched on the main thread.
   NS_DECL_EVENT_HANDLER(blocked)
   NS_DECL_EVENT_HANDLER(upgradeneeded)

diff --git a/dom/indexedDB/IDBWrapperCache.cpp b/dom/indexedDB/IDBWrapperCache.cpp
@@ -51,7 +51,13 @@ IDBWrapperCache::~IDBWrapperCache()
 bool
 IDBWrapperCache::SetScriptOwner(JSObject* aScriptOwner)
 {
-  NS_ASSERTION(!aScriptOwner, "This should never be null!");
+  if (!aScriptOwner) {
+    NS_ASSERTION(!mScriptOwner,
+                 "Don't null out existing owner, we need to call "
+                 "DropJSObjects!");
+
+    return true;
+  }
 
   mScriptOwner = aScriptOwner;