[DOM] Convert cleanup of FlushCurrentWord() to a ScopeExit task.

Ensures consistent cleanup even if early exit due to OOM.

dom/base/StructuredCloneHolder.cpp

@@ -1343,7 +1343,6 @@ StructuredCloneHolder::CustomReadTransferHandler(JSContext* aCx,
       static_cast<OffscreenCanvasCloneData*>(aContent);
     nsCOMPtr<nsIGlobalObject> parent = do_QueryInterface(mParent);
     RefPtr<OffscreenCanvas> canvas = OffscreenCanvas::CreateFromCloneData(parent, data);
-    delete data;
 
     JS::Rooted<JS::Value> value(aCx);
     if (!GetOrCreateDOMReflector(aCx, canvas, &value)) {
@@ -1351,6 +1350,7 @@ StructuredCloneHolder::CustomReadTransferHandler(JSContext* aCx,
       return false;
     }
 
+    delete data;
     aReturnObject.set(&value.toObject());
     return true;
   }
@@ -1363,7 +1363,6 @@ StructuredCloneHolder::CustomReadTransferHandler(JSContext* aCx,
       static_cast<ImageBitmapCloneData*>(aContent);
     nsCOMPtr<nsIGlobalObject> parent = do_QueryInterface(mParent);
     RefPtr<ImageBitmap> bitmap = ImageBitmap::CreateFromCloneData(parent, data);
-    delete data;
 
     JS::Rooted<JS::Value> value(aCx);
     if (!GetOrCreateDOMReflector(aCx, bitmap, &value)) {
@@ -1371,6 +1370,7 @@ StructuredCloneHolder::CustomReadTransferHandler(JSContext* aCx,
       return false;
     }
 
+    delete data;
     aReturnObject.set(&value.toObject());
     return true;
   }

dom/base/nsLineBreaker.cpp

@@ -10,6 +10,7 @@
 #include "nsHyphenationManager.h"
 #include "nsHyphenator.h"
 #include "mozilla/gfx/2D.h"
+#include "mozilla/ScopeExit.h"
 
 nsLineBreaker::nsLineBreaker()
   : mCurrentWordLanguage(nullptr),
@@ -57,6 +58,14 @@ SetupCapitalization(const char16_t* aWord, uint32_t aLength,
 nsresult
 nsLineBreaker::FlushCurrentWord()
 {
+  auto cleanup = mozilla::MakeScopeExit([&] {
+    mCurrentWord.Clear();
+    mTextItems.Clear();
+    mCurrentWordContainsComplexChar = false;
+    mCurrentWordContainsMixedLang = false;
+    mCurrentWordLanguage = nullptr;
+  });
+
   uint32_t length = mCurrentWord.Length();
   AutoTArray<uint8_t,4000> breakState;
   if (!breakState.AppendElements(length))
@@ -137,11 +146,6 @@ nsLineBreaker::FlushCurrentWord()
     offset += ti->mLength;
   }
 
-  mCurrentWord.Clear();
-  mTextItems.Clear();
-  mCurrentWordContainsComplexChar = false;
-  mCurrentWordContainsMixedLang = false;
-  mCurrentWordLanguage = nullptr;
   return NS_OK;
 }
 

netwerk/base/nsIOService.cpp

@@ -1437,6 +1437,11 @@ nsIOService::Observe(nsISupports *subject,
             nsCOMPtr<nsIPrefBranch> prefBranch;
             GetPrefBranch(getter_AddRefs(prefBranch));
             PrefsChanged(prefBranch, MANAGE_OFFLINE_STATUS_PREF);
+
+            // Issue #2672 - Read cookie database at an early-as-possible time
+            // off main thread. Hence, we have more chance to finish db query
+            // before something calls into the cookie service.
+            nsCOMPtr<nsISupports> cookieServ = do_GetService(NS_COOKIESERVICE_CONTRACTID);
         }
     } else if (!strcmp(topic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
         // Remember we passed XPCOM shutdown notification to prevent any

netwerk/cookie/nsCookieService.h

@@ -28,9 +28,12 @@
 #include "mozIStorageFunction.h"
 #include "nsIVariant.h"
 #include "nsIFile.h"
+#include "mozilla/Atomics.h"
 #include "mozilla/BasePrincipal.h"
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/Maybe.h"
+#include "mozilla/Monitor.h"
+#include "mozilla/UniquePtr.h"
 
 using mozilla::NeckoOriginAttributes;
 using mozilla::OriginAttributes;
@@ -43,6 +46,7 @@ class nsIObserverService;
 class nsIURI;
 class nsIChannel;
 class nsIArray;
+class nsIThread;
 class mozIStorageService;
 class mozIThirdPartyUtil;
 class ReadCookieDBListener;
@@ -145,13 +149,49 @@ class nsCookieEntry : public nsCookieKey
     ArrayType mCookies;
 };
 
+// struct for a constant cookie for threadsafe
+struct ConstCookie
+{
+  ConstCookie(const nsCString& aName,
+              const nsCString& aValue,
+              const nsCString& aHost,
+              const nsCString& aPath,
+              int64_t aExpiry,
+              int64_t aLastAccessed,
+              int64_t aCreationTime,
+              bool aIsSecure,
+              bool aIsHttpOnly,
+              const OriginAttributes &aOriginAttributes)
+    : name(aName)
+    , value(aValue)
+    , host(aHost)
+    , path(aPath)
+    , expiry(aExpiry)
+    , lastAccessed(aLastAccessed)
+    , creationTime(aCreationTime)
+    , isSecure(aIsSecure)
+    , isHttpOnly(aIsHttpOnly)
+    , originAttributes(aOriginAttributes)
+  {
+  }
+
+  const nsCString name;
+  const nsCString value;
+  const nsCString host;
+  const nsCString path;
+  const int64_t expiry;
+  const int64_t lastAccessed;
+  const int64_t creationTime;
+  const bool isSecure;
+  const bool isHttpOnly;
+  const OriginAttributes originAttributes;
+};
+
 // encapsulates a (key, nsCookie) tuple for temporary storage purposes.
 struct CookieDomainTuple
 {
   nsCookieKey key;
-  RefPtr<nsCookie> cookie;
-
-  size_t SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+  mozilla::UniquePtr<ConstCookie> cookie;
 };
 
 // encapsulates in-memory and on-disk DB states, so we can
@@ -194,17 +234,9 @@ public:
   // while the background read is taking place.
   nsCOMPtr<mozIStorageConnection>       syncConn;
   nsCOMPtr<mozIStorageStatement>        stmtReadDomain;
-  nsCOMPtr<mozIStoragePendingStatement> pendingRead;
   // The asynchronous read listener. This is a weak ref (storage has ownership)
   // since it may need to outlive the DBState's database connection.
   ReadCookieDBListener*                 readListener;
-  // An array of (baseDomain, cookie) tuples representing data read in
-  // asynchronously. This is merged into hostTable once read is complete.
-  nsTArray<CookieDomainTuple>           hostArray;
-  // A hashset of baseDomains read in synchronously, while the async read is
-  // in flight. This is used to keep track of which data in hostArray is stale
-  // when the time comes to merge.
-  nsTHashtable<nsCookieKey>        readSet;
 
   // DB completion handlers.
   nsCOMPtr<mozIStorageStatementCallback>  insertListener;
@@ -266,6 +298,8 @@ class nsCookieService final : public nsICookieService
     void                          PrefChanged(nsIPrefBranch *aPrefBranch);
     void                          InitDBStates();
     OpenDBResult                  TryInitDB(bool aDeleteExistingDB);
+    void                          InitDBConn();
+    nsresult                      InitDBConnInternal();
     nsresult                      CreateTable();
     nsresult                      CreateTableForSchemaVersion6();
     nsresult                      CreateTableForSchemaVersion5();
@@ -276,11 +310,8 @@ class nsCookieService final : public nsICookieService
     void                          HandleCorruptDB(DBState* aDBState);
     void                          RebuildCorruptDB(DBState* aDBState);
     OpenDBResult                  Read();
-    template<class T> nsCookie*   GetCookieFromRow(T &aRow, const OriginAttributes& aOriginAttributes);
-    void                          AsyncReadComplete();
-    void                          CancelAsyncRead(bool aPurgeReadSet);
-    void                          EnsureReadDomain(const nsCookieKey &aKey);
-    void                          EnsureReadComplete();
+    mozilla::UniquePtr<ConstCookie> GetCookieFromRow(mozIStorageStatement *aRow, const OriginAttributes &aOriginAttributes);
+    void                          EnsureReadComplete(bool aInitDBConn);
     nsresult                      NormalizeHost(nsCString &aHost);
     nsresult                      GetBaseDomain(nsIURI *aHostURI, nsCString &aBaseDomain, bool &aRequireHostMatch);
     nsresult                      GetBaseDomainFromHost(const nsACString &aHost, nsCString &aBaseDomain);
@@ -351,6 +382,13 @@ class nsCookieService final : public nsICookieService
     uint16_t                      mMaxCookiesPerHost;
     int64_t                       mCookiePurgeAge;
 
+    // thread props
+    nsCOMPtr<nsIThread>           mThread;
+    mozilla::Monitor              mMonitor;
+    mozilla::Atomic<bool>         mInitializedDBStates;
+    mozilla::Atomic<bool>         mInitializedDBConn;
+    nsTArray<CookieDomainTuple>   mReadArray;
+
     // friends!
     friend class DBListenerErrorHandler;
     friend class ReadCookieDBListener;

netwerk/protocol/http/nsHttpConnection.cpp

@@ -323,7 +323,8 @@ nsHttpConnection::StartSpdy(uint8_t spdyVersion)
     if (!mTLSFilter) {
         mTransaction = mSpdySession;
     } else {
-        mTLSFilter->SetProxiedTransaction(mSpdySession);
+        rv = mTLSFilter->SetProxiedTransaction(mSpdySession);
+        NS_ENSURE_SUCCESS_VOID(rv);
     }
     if (mDontReuse) {
         mSpdySession->DontReuse();
@@ -355,6 +356,7 @@ nsHttpConnection::EnsureNPNComplete(nsresult &aOut0RTTWriteHandshakeValue,
     nsCOMPtr<nsISupports> securityInfo;
     nsCOMPtr<nsISSLSocketControl> ssl;
     nsAutoCString negotiatedNPN;
+    nsAutoCString transactionNPN;
 
     GetSecurityInfo(getter_AddRefs(securityInfo));
     if (!securityInfo) {
@@ -373,6 +375,18 @@ nsHttpConnection::EnsureNPNComplete(nsresult &aOut0RTTWriteHandshakeValue,
     }
 
     rv = ssl->GetNegotiatedNPN(negotiatedNPN);
+
+    // Check if the connection NPN matches negotiated NPN.
+    transactionNPN = mConnInfo->GetNPNToken();
+    LOG(("negotiatedNPN: %s - transactionNPN: %s", negotiatedNPN.get(),
+         transactionNPN.get()));
+    if (!transactionNPN.IsEmpty() && negotiatedNPN != transactionNPN) {
+      LOG(("Resetting connection due to mismatched NPN token"));
+      DontReuse();
+      mTransaction->Close(NS_ERROR_NET_RESET);
+      return true;
+    }
+
     if (!m0RTTChecked && (rv == NS_ERROR_NOT_CONNECTED) &&
         !mConnInfo->UsingProxy()) {
         // There is no ALPN info (yet!). We need to consider doing 0RTT. We