wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Backout 9423207656dd and d226a39b4181 (Bug 863792) for triggering bug 854082 crashes, the fix for which was backed out. CLOSED TREE

Browse Source
This commit is contained in:
John Schoenick 2013-04-22 16:29:54 -07:00
parent 34e21f4536
commit da79205d6c
4 changed files with 3 additions and 112 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
content/base/src/nsObjectLoadingContent.cpp
View File

@ -745,8 +745,6 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
// Flush layout so that the frame is created if possible and the plugin is
// initialized with the latest information.
doc->FlushPendingNotifications(Flush_Layout);
// Flushing layout may have re-entered and loaded something underneath us
NS_ENSURE_TRUE(mInstantiating, NS_OK);
if (!thisContent->GetPrimaryFrame()) {
LOG(("OBJLC [%p]: Not instantiating plugin with no frame", this));
@ -769,36 +767,18 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
appShell->SuspendNative();
}
nsRefPtr<nsPluginInstanceOwner> newOwner;
rv = pluginHost->InstantiatePluginInstance(mContentType.get(),
mURI.get(), this,
getter_AddRefs(newOwner));
getter_AddRefs(mInstanceOwner));
// XXX(johns): We don't suspend native inside stopping plugins...
if (appShell) {
appShell->ResumeNative();
}
if (!mInstantiating || NS_FAILED(rv)) {
LOG(("OBJLC [%p]: Plugin instantiation failed or re-entered, "
"killing old instance", this));
// XXX(johns): This needs to be de-duplicated with DoStopPlugin, but we
// don't want to touch the protochain or delayed stop.
// (Bug 767635)
if (newOwner) {
nsRefPtr<nsNPAPIPluginInstance> inst;
newOwner->GetInstance(getter_AddRefs(inst));
newOwner->SetFrame(nullptr);
if (inst) {
pluginHost->StopPluginInstance(inst);
}
newOwner->Destroy();
}
return NS_OK;
if (NS_FAILED(rv)) {
return rv;
}
mInstanceOwner = newOwner;
// Set up scripting interfaces.
NotifyContentObjectWrapper();
@ -2176,10 +2156,6 @@ nsObjectLoadingContent::UnloadObject(bool aResetState)
mOriginalContentType.Truncate();
}
// InstantiatePluginInstance checks this after re-entrant calls and aborts if
// it was cleared from under it
mInstantiating = false;
mScriptRequested = false;
// This call should be last as it may re-enter

2
dom/plugins/test/mochitest/Makefile.in
View File

@ -67,8 +67,6 @@ MOCHITEST_FILES = \
test_bug751809.html \
test_bug813906.html \
test_bug784131.html \
test_bug863792.html \
file_bug863792.html \
test_enumerate.html \
test_npruntime_construct.html \
307-xo-redirect.sjs \

45
dom/plugins/test/mochitest/file_bug863792.html
View File

@ -1,45 +0,0 @@
<!doctype html>
<html>
<head>
<title>File for Bug 863792</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<base href="chrome://browser/content/">
</head>
<body>
<script type="application/javascript">
// A plugin that removes itself from the document and inactivates said document
// inside NPP_New. We should not leak the instance. See also test_bug854082
var outerwindow = window;
var i = document.createElement("iframe");
i.width = 500;
i.height = 500;
var ob = document.body;
document.body.appendChild(i);
i.addEventListener("load", function loaded() {
var id = i.contentDocument;
var e = id.createElement("embed");
var callbackrun = false;
e.width = 200;
e.height = 200;
e.type = "application/x-test";
e.__defineSetter__("pluginFoundElement", function() {
window.console.log("pluginFoundElement");
e.style.display = "none";
e.clientTop;
i.removeEventListener("load", loaded);
ob.removeChild(i);
id.body.clientTop;
id.body.removeChild(e);
callbackrun = true;
});
id.body.appendChild(e);
e.clientTop;
e = id = i = ob = null;
SpecialPowers.forceCC(); SpecialPowers.forceGC();
}, false);
</script>
</body>
</html>

38
dom/plugins/test/mochitest/test_bug863792.html
View File

@ -1,38 +0,0 @@
<!doctype html>
<html>
<head>
<title>Test for Bug 863792</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body>
<script type="application/javascript">
// A plugin that removes itself from the document and inactivates said document
// inside NPP_New. We should not leak the instance. See also test_bug854082
SimpleTest.waitForExplicitFinish();
var i = document.createElement("iframe");
i.src = "file_bug863792.html";
i.width = 500;
i.height = 500;
document.body.appendChild(i);
i.addEventListener("load", function() {
SpecialPowers.forceGC();
SpecialPowers.forceCC();
SimpleTest.executeSoon(function() {
SpecialPowers.forceGC();
SpecialPowers.forceCC();
SimpleTest.executeSoon(function() {
ok(true, "Didn't crash");
SimpleTest.finish();
});
});
}, false);
</script>
</body>
</html>