From d0ab9863a14d9e1ae07bb96fef6df81169732bf3 Mon Sep 17 00:00:00 2001 From: "joki%netscape.com" Date: Wed, 27 Jun 2001 04:48:50 +0000 Subject: [PATCH] Fix 0.9.2 bug. Add code to prevent double release of timeout during reentrant timeout dispatch. sr:jst, r:vidur, pr:beard git-svn-id: svn://10.0.0.236/branches/MOZILLA_0_9_2_BRANCH@98045 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/dom/src/base/nsGlobalWindow.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/mozilla/dom/src/base/nsGlobalWindow.cpp b/mozilla/dom/src/base/nsGlobalWindow.cpp index b4b5010baaf..30c6aa25540 100644 --- a/mozilla/dom/src/base/nsGlobalWindow.cpp +++ b/mozilla/dom/src/base/nsGlobalWindow.cpp @@ -3627,6 +3627,7 @@ GlobalWindowImpl::ClearTimeoutOrInterval(PRInt32 aTimerID) /* Delete the timeout from the pending timeout list */ *top = timeout->next; if (timeout->timer) { + NS_ASSERTION(timeout->ref_count > 1, "Low ref_count on dropping timeout"); timeout->timer->Cancel(); DropTimeout(timeout); } @@ -3689,7 +3690,13 @@ void nsGlobalWindow_RunTimeout(nsITimer *aTimer, void *aClosure) if (timeout->window->RunTimeout(timeout)) { // Drop the ref_count since the timer won't be holding on to the - // timeout struct anymore + // timeout struct anymore. If the timeout isn't an interval then + // we also want to null out its ref to the timer so that it won't + // assume the time is holding a ref to it later if this DropTimeout + // call doesn't bring its refcnt to 0 and end up deleting it. + if (!timeout->interval) { + timeout->timer = nsnull; + } timeout->window->DropTimeout(timeout); } }