guix-devel/gnu/packages/patches/icecat-CVE-2015-2722-pt2.patch

74 lines
2.0 KiB
Diff

From 6eb772aa6a0c1b21aafcfa606cc3bf07659b53b9 Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Wed, 27 May 2015 14:33:22 -0700
Subject: [PATCH] Bug 1166924 part 1 r=baku a=lizzard
--HG--
extra : source : 528d47773256bfee72e7adedc78b89c9fa573b7b
---
dom/workers/XMLHttpRequest.cpp | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
index 8e4200a..bf0cd3f 100644
--- a/dom/workers/XMLHttpRequest.cpp
+++ b/dom/workers/XMLHttpRequest.cpp
@@ -140,7 +140,7 @@ public:
Init();
void
- Teardown();
+ Teardown(bool aSendUnpin);
bool
AddRemoveEventListeners(bool aUpload, bool aAdd);
@@ -308,7 +308,9 @@ private:
{
AssertIsOnMainThread();
- mProxy->Teardown();
+ // This means the XHR was GC'd, so we can't be pinned, and we don't need to
+ // try to unpin.
+ mProxy->Teardown(/* aSendUnpin */ false);
mProxy = nullptr;
return NS_OK;
@@ -563,7 +565,7 @@ private:
virtual nsresult
MainThreadRun() MOZ_OVERRIDE
{
- mProxy->Teardown();
+ mProxy->Teardown(/* aSendUnpin */ true);
MOZ_ASSERT(!mProxy->mSyncLoopTarget);
return NS_OK;
}
@@ -935,7 +937,7 @@ Proxy::Init()
}
void
-Proxy::Teardown()
+Proxy::Teardown(bool aSendUnpin)
{
AssertIsOnMainThread();
@@ -948,10 +950,12 @@ Proxy::Teardown()
mXHR->Abort();
if (mOutstandingSendCount) {
- nsRefPtr<XHRUnpinRunnable> runnable =
- new XHRUnpinRunnable(mWorkerPrivate, mXMLHttpRequestPrivate);
- if (!runnable->Dispatch(nullptr)) {
- NS_RUNTIMEABORT("We're going to hang at shutdown anyways.");
+ if (aSendUnpin) {
+ nsRefPtr<XHRUnpinRunnable> runnable =
+ new XHRUnpinRunnable(mWorkerPrivate, mXMLHttpRequestPrivate);
+ if (!runnable->Dispatch(nullptr)) {
+ NS_RUNTIMEABORT("We're going to hang at shutdown anyways.");
+ }
}
if (mSyncLoopTarget) {
--
2.4.3