Bug 1278201 - prevent writing |mRefCnt| after it's freed. r?Ms2ger draft
authorAndi-Bogdan Postelnicu <bpostelnicu@mozilla.com>
Mon, 06 Jun 2016 17:23:10 +0300
changeset 375676 ebbce3a8636131c2037e7f231a709e9da333bb24
parent 375369 3e8ee3599a67edd971770af4982ad4b0fe77f073
child 522938 5c1d40bbbbcfcc61d2155176642fa120bfd5bda3
push id20350
push userBogdan.Postelnicu@softvision.ro
push dateMon, 06 Jun 2016 14:23:42 +0000
reviewersMs2ger
bugs1278201
milestone49.0a1
Bug 1278201 - prevent writing |mRefCnt| after it's freed. r?Ms2ger MozReview-Commit-ID: G7fZzrGWHmW
mfbt/tests/TestNotNull.cpp
--- a/mfbt/tests/TestNotNull.cpp
+++ b/mfbt/tests/TestNotNull.cpp
@@ -62,20 +62,21 @@ public:
     if (mRefCnt > mMaxRefCnt) {
       mMaxRefCnt = mRefCnt;
     }
     return mRefCnt;
   }
 
   uint32_t Release() {
     CHECK(mRefCnt > 0);
-    if (mRefCnt == 1) {
+    mRefCnt--;
+    if (mRefCnt == 0) {
       delete this;
+      return 0;
     }
-    mRefCnt--;
     return mRefCnt;
   }
 };
 
 void f_i(int* aPtr) {}
 void f_my(MyPtr<int> aPtr) {}
 
 void f_nni(NotNull<int*> aPtr) {}