From 2528bfde89bf1ef0e3b1cd12485b4bd89c30758c Mon Sep 17 00:00:00 2001 From: "dougt%netscape.com" Date: Tue, 3 Dec 2002 23:04:28 +0000 Subject: [PATCH] Fix for nsProxyObjectManager::GetProxy() memory corruption. Patch by wolruf@free.fr, r=dougt, sr=alecf, b=182572 git-svn-id: svn://10.0.0.236/trunk@134730 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp b/mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp index 0aeb708e5aa..89cd4b2bd1c 100644 --- a/mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp +++ b/mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp @@ -81,7 +81,6 @@ class nsProxyCreateInstance : public nsIProxyCreateInstance nsProxyCreateInstance::nsProxyCreateInstance() { NS_INIT_ISUPPORTS(); - NS_ADDREF_THIS(); } nsProxyCreateInstance::~nsProxyCreateInstance() @@ -252,11 +251,14 @@ nsProxyObjectManager::GetProxy( nsIEventQueue *destQueue, // 1. Create a proxy for creating an instance on another thread. nsIProxyCreateInstance* ciProxy = nsnull; - nsProxyCreateInstance* ciObject = new nsProxyCreateInstance(); + + nsProxyCreateInstance* ciObject = new nsProxyCreateInstance(); if (ciObject == nsnull) return NS_ERROR_NULL_POINTER; + NS_ADDREF(ciObject); + nsresult rv = GetProxyForObject(destQueue, NS_GET_IID(nsIProxyCreateInstance), ciObject, @@ -265,7 +267,7 @@ nsProxyObjectManager::GetProxy( nsIEventQueue *destQueue, if (NS_FAILED(rv)) { - delete ciObject; + NS_RELEASE(ciObject); return rv; } @@ -282,9 +284,7 @@ nsProxyObjectManager::GetProxy( nsIEventQueue *destQueue, // 3. Delete the create instance proxy and its real object. NS_RELEASE(ciProxy); - delete ciObject; - ciObject = nsnull; - + NS_RELEASE(ciObject); // 4. Check to see if creating the requested instance failed. if ( NS_FAILED(rv)) @@ -296,7 +296,6 @@ nsProxyObjectManager::GetProxy( nsIEventQueue *destQueue, rv = GetProxyForObject(destQueue, aIID, aObj, proxyType, aProxyObject); - // 6. release ownership of aObj so that aProxyObject owns it. NS_RELEASE(aObj);