From: Marco Bonardo <mbonardo@mozilla.com>
Date: Wed, 9 Mar 2011 13:31:44 -0800
Subject: Bug 637957 - Make notifiers strong owners of mCallback, to prevent
 crashes due to unexpected events ordering

---
 storage/src/mozStorageEvents.cpp |   18 ++++++++++++++++--
 1 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/storage/src/mozStorageEvents.cpp b/storage/src/mozStorageEvents.cpp
index b91640e..26c7e15 100644
--- a/storage/src/mozStorageEvents.cpp
+++ b/storage/src/mozStorageEvents.cpp
@@ -111,8 +111,15 @@ public:
   {
     NS_ASSERTION(mCallback, "Trying to notify about results without a callback!");
 
-    if (mEventStatus->runEvent())
+    if (mEventStatus->runEvent()) {
+      // Hold a strong reference to the callback while notifying it, so that if
+      // it spins the event loop, the callback won't be released and freed out
+      // from under us.
+      nsCOMPtr<mozIStorageStatementCallback> callback =
+        do_QueryInterface(mCallback);
+
       (void)mCallback->HandleResult(mResults);
+    }
 
     return NS_OK;
   }
@@ -148,8 +155,15 @@ public:
 
   NS_IMETHOD Run()
   {
-    if (mEventStatus->runEvent() && mCallback)
+    if (mEventStatus->runEvent() && mCallback) {
+      // Hold a strong reference to the callback while notifying it, so that if
+      // it spins the event loop, the callback won't be released and freed out
+      // from under us.
+      nsCOMPtr<mozIStorageStatementCallback> callback =
+        do_QueryInterface(mCallback);
+
       (void)mCallback->HandleError(mErrorObj);
+    }
 
     return NS_OK;
   }
