From 221098d707210d2496b7cb9e202f7e58a9e68598 Mon Sep 17 00:00:00 2001
From: "benjamin%smedbergs.us"
 <benjamin%smedbergs.us@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 25 May 2007 11:18:18 +0000
Subject: [PATCH] Bug 337492 - Fix destructor race condition in proxy events,
 initial patch by Alex Fritze, with additional comments by me, r=me+dbaron

git-svn-id: svn://10.0.0.236/trunk@227010 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/xpcom/proxy/src/nsProxyEventObject.cpp | 9 +++++++--
 mozilla/xpcom/proxy/src/nsProxyEventPrivate.h  | 3 ++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/mozilla/xpcom/proxy/src/nsProxyEventObject.cpp b/mozilla/xpcom/proxy/src/nsProxyEventObject.cpp
index 671321633d4..69981ded313 100644
--- a/mozilla/xpcom/proxy/src/nsProxyEventObject.cpp
+++ b/mozilla/xpcom/proxy/src/nsProxyEventObject.cpp
@@ -57,9 +57,9 @@ nsProxyEventObject::nsProxyEventObject(nsProxyObject *aParent,
                             nsProxyEventClass* aClass,
                             already_AddRefed<nsISomeInterface> aRealInterface,
                             nsresult *rv)
-    : mRealInterface(aRealInterface),
-      mClass(aClass),
+    : mClass(aClass),
       mProxyObject(aParent),
+      mRealInterface(aRealInterface),
       mNext(nsnull)
 {
     *rv = InitStub(aClass->GetProxiedIID());
@@ -71,6 +71,11 @@ nsProxyEventObject::~nsProxyEventObject()
     // XXX assert this!
 
     mProxyObject->LockedRemove(this);
+
+    // mRealInterface must be released before mProxyObject so that the last
+    // release of the proxied object is proxied to the correct thread.
+    // See bug 337492.
+    mRealInterface = nsnull;
 }
 
 //
diff --git a/mozilla/xpcom/proxy/src/nsProxyEventPrivate.h b/mozilla/xpcom/proxy/src/nsProxyEventPrivate.h
index 04cbe279107..61b30e8f27d 100644
--- a/mozilla/xpcom/proxy/src/nsProxyEventPrivate.h
+++ b/mozilla/xpcom/proxy/src/nsProxyEventPrivate.h
@@ -181,9 +181,10 @@ public:
 private:
     ~nsProxyEventObject();
 
-    nsCOMPtr<nsISomeInterface>  mRealInterface;
+    // Member ordering is important: See note in the destructor.
     nsProxyEventClass          *mClass;
     nsCOMPtr<nsProxyObject>     mProxyObject;
+    nsCOMPtr<nsISomeInterface>  mRealInterface;
 
     // Weak reference, maintained by the parent nsProxyObject
     nsProxyEventObject         *mNext;