From e07d4a4dda13739aef44ce392747dfc2d85559da Mon Sep 17 00:00:00 2001 From: "bruce%cybersight.com" Date: Mon, 21 Feb 2000 21:56:49 +0000 Subject: [PATCH] Fixes a free memory read due to premature destruction of the timer object. Thanks Pavlov. a=waterson. r=bruce,pavlov git-svn-id: svn://10.0.0.236/trunk@61391 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/widget/timer/src/unix/gtk/nsTimerGtk.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mozilla/widget/timer/src/unix/gtk/nsTimerGtk.cpp b/mozilla/widget/timer/src/unix/gtk/nsTimerGtk.cpp index 8dda54abbf1..ef4f9a5931a 100644 --- a/mozilla/widget/timer/src/unix/gtk/nsTimerGtk.cpp +++ b/mozilla/widget/timer/src/unix/gtk/nsTimerGtk.cpp @@ -22,6 +22,7 @@ */ #include "nsTimerGtk.h" +#include "nsCOMPtr.h" static NS_DEFINE_IID(kITimerIID, NS_ITIMER_IID); @@ -43,6 +44,9 @@ PRBool nsTimerGtk::FireTimeout() mTimerId = g_timeout_add_full(calc_priority(mPriority), mDelay, nsTimerExpired, this, NULL); } + + // because Notify can cause 'this' to get destroyed, we need to hold a ref + nsCOMPtr kungFuDeathGrip = this; if (mFunc != NULL) { (*mFunc)(this, mClosure);