763013 - Race condition in async stream copier

Status: RESOLVED FIXED

Description

[Jan Varga [:janv]]

nsAsyncStreamCopier::AsyncCopy() calls NS_AsyncCopy()
The background thread can copy the stream so quickly that it calls the complete callback before NS_AsyncCopy() finishes.

So the main thread calls NS_AsyncCopy() and executes:
*aCopierCtx = static_cast<nsISupports*>(
              static_cast<nsIRunnable*>(copier));

context switch

The background thread finishes copying, calls nsAsyncStreamCopier::OnAsyncCopyComplete() and then nsAsyncStreamCopier::Complete()
which executes:
MutexAutoLock lock(mLock);
mCopierCtx = nsnull;

context switch

The main thread executes:
NS_ADDREF(*aCopierCtx);
which is now null


Testing a fix on try ...

Comment 1

[Jan Varga [:janv]]

seems like there's a similar bug filed already, bug 559927

Comment 2

[Jan Varga [:janv]]

Created attachment 631648 [details] [diff] [review]
fix

Comment 3

[Jan Varga [:janv]]

the fix passed on try

Comment 4

[Jan Varga [:janv]]

we need this to fix bug 762024

Comment 5

[Jan Varga [:janv]]

http://hg.mozilla.org/mozilla-central/rev/72419c5d84df