From 6ffa315eb56f331fe71375e66d391ba17b3098fb Mon Sep 17 00:00:00 2001
From: "benjamin%smedbergs.us"
 <benjamin%smedbergs.us@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 14 Sep 2007 18:21:28 +0000
Subject: [PATCH] Bug 393935 - Crash [@nsProxyObject::LockedFind] due to
 threads racing, r=brendan

git-svn-id: svn://10.0.0.236/trunk@235982 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../xpcom/proxy/src/nsProxyObjectManager.cpp  | 38 +++++++++++++++++--
 1 file changed, 35 insertions(+), 3 deletions(-)

diff --git a/mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp b/mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp
index 3d7ba2c6dda..2905c3f778a 100644
--- a/mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp
+++ b/mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp
@@ -148,6 +148,36 @@ nsProxyObjectManager::Create(nsISupports* outer, const nsIID& aIID,
     return proxyObjectManager->QueryInterface(aIID, aInstancePtr);
 }
 
+class nsProxyLockedRefPtr
+{
+public:
+    nsProxyLockedRefPtr(nsProxyObject* aPtr) :
+        mProxyObject(aPtr)
+    {
+        if (mProxyObject)
+            mProxyObject->LockedAddRef();
+    }
+
+    ~nsProxyLockedRefPtr()
+    {
+        if (mProxyObject)
+            mProxyObject->LockedRelease();
+    }
+
+    operator nsProxyObject*() const
+    {
+        return mProxyObject;
+    }
+
+    nsProxyObject* operator->() const
+    {
+        return mProxyObject;
+    }
+
+private:
+    nsProxyObject *mProxyObject;
+};
+
 NS_IMETHODIMP 
 nsProxyObjectManager::GetProxyForObject(nsIEventTarget* aTarget, 
                                         REFNSIID aIID, 
@@ -195,8 +225,8 @@ nsProxyObjectManager::GetProxyForObject(nsIEventTarget* aTarget,
 
     {
         nsAutoLock lock(mProxyCreationLock);
-                nsProxyObject *root =
-                    (nsProxyObject*) mProxyObjectMap.Get(&rootKey);
+        nsProxyLockedRefPtr root =
+            (nsProxyObject*) mProxyObjectMap.Get(&rootKey);
         if (root)
             return root->LockedFind(aIID, aProxyObject);
     }
@@ -209,7 +239,7 @@ nsProxyObjectManager::GetProxyForObject(nsIEventTarget* aTarget,
     // lock again, and check for a race putting into mProxyObjectMap
     {
         nsAutoLock lock(mProxyCreationLock);
-        nsProxyObject *root =
+        nsProxyLockedRefPtr root = 
             (nsProxyObject*) mProxyObjectMap.Get(&rootKey);
         if (root) {
             delete newRoot;
@@ -217,6 +247,8 @@ nsProxyObjectManager::GetProxyForObject(nsIEventTarget* aTarget,
         }
 
         mProxyObjectMap.Put(&rootKey, newRoot);
+
+        nsProxyLockedRefPtr kungFuDeathGrip(newRoot);
         return newRoot->LockedFind(aIID, aProxyObject);
     }
 }