mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Backout e3eaea876a18, 3aaf738a04d8, and 43d1b14e8920 (Bug 854082) for orange on a CLOSED TREE

This commit is contained in:
John Schoenick 2013-04-22 14:57:24 -07:00
Родитель 4514ee2bc1
Коммит 1318029be2
5 изменённых файлов: 13 добавлений и 64 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

17
content/base/src/nsObjectLoadingContent.cpp
Просмотреть файл

@ -799,14 +799,6 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
mInstanceOwner = newOwner; mInstanceOwner = newOwner;
// Ensure the frame did not change during instantiation re-entry (common).
// HasNewFrame would not have mInstanceOwner yet, so the new frame would be
// dangling. (Bug 854082)
nsIFrame* frame = thisContent->GetPrimaryFrame();
if (frame && mInstanceOwner) {
mInstanceOwner->SetFrame(static_cast<nsObjectFrame*>(frame));
}
// Set up scripting interfaces. // Set up scripting interfaces.
NotifyContentObjectWrapper(); NotifyContentObjectWrapper();
@ -1039,10 +1031,16 @@ nsObjectLoadingContent::HasNewFrame(nsIObjectFrame* aFrame)
} }
// Otherwise, we're just changing frames // Otherwise, we're just changing frames
mInstanceOwner->SetFrame(nullptr);
// Set up relationship between instance owner and frame. // Set up relationship between instance owner and frame.
nsObjectFrame *objFrame = static_cast<nsObjectFrame*>(aFrame); nsObjectFrame *objFrame = static_cast<nsObjectFrame*>(aFrame);
mInstanceOwner->SetFrame(objFrame); mInstanceOwner->SetFrame(objFrame);
// Set up new frame to draw.
objFrame->FixupWindow(objFrame->GetContentRectRelativeToSelf().Size());
objFrame->InvalidateFrame();
return NS_OK; return NS_OK;
} }
@ -2320,6 +2318,7 @@ nsObjectLoadingContent::PluginDestroyed()
// plugins in plugin host. Invalidate instance owner / prototype but otherwise // plugins in plugin host. Invalidate instance owner / prototype but otherwise
// don't take any action. // don't take any action.
TeardownProtoChain(); TeardownProtoChain();
mInstanceOwner->SetFrame(nullptr);
mInstanceOwner->Destroy(); mInstanceOwner->Destroy();
mInstanceOwner = nullptr; mInstanceOwner = nullptr;
return NS_OK; return NS_OK;
@ -2603,8 +2602,6 @@ nsObjectLoadingContent::StopPluginInstance()
CloseChannel(); CloseChannel();
} }
// We detach the instance owner's frame before destruction, but don't destroy
// the instance owner until the plugin is stopped.
mInstanceOwner->SetFrame(nullptr); mInstanceOwner->SetFrame(nullptr);
bool delayedStop = false; bool delayedStop = false;

5
dom/plugins/base/nsPluginInstanceOwner.cpp
Просмотреть файл

@ -2504,7 +2504,8 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
nsresult nsresult
nsPluginInstanceOwner::Destroy() nsPluginInstanceOwner::Destroy()
{ {
SetFrame(nullptr); if (mObjectFrame)
mObjectFrame->SetInstanceOwner(nullptr);
#ifdef XP_MACOSX #ifdef XP_MACOSX
RemoveFromCARefreshTimer(); RemoveFromCARefreshTimer();
@ -3376,7 +3377,7 @@ void nsPluginInstanceOwner::SetFrame(nsObjectFrame *aFrame)
} }
mObjectFrame->FixupWindow(mObjectFrame->GetContentRectRelativeToSelf().Size()); mObjectFrame->FixupWindow(mObjectFrame->GetContentRectRelativeToSelf().Size());
mObjectFrame->InvalidateFrame(); mObjectFrame->InvalidateFrame();
nsFocusManager* fm = nsFocusManager::GetFocusManager(); nsFocusManager* fm = nsFocusManager::GetFocusManager();
const nsIContent* content = aFrame->GetContent(); const nsIContent* content = aFrame->GetContent();
if (fm && content) { if (fm && content) {

1
dom/plugins/test/mochitest/Makefile.in
Просмотреть файл

@ -67,7 +67,6 @@ MOCHITEST_FILES = \
test_bug751809.html \ test_bug751809.html \
test_bug813906.html \ test_bug813906.html \
test_bug784131.html \ test_bug784131.html \
test_bug854082.html \
test_bug863792.html \ test_bug863792.html \
file_bug863792.html \ file_bug863792.html \
test_enumerate.html \ test_enumerate.html \

39
dom/plugins/test/mochitest/test_bug854082.html
Просмотреть файл

@ -1,39 +0,0 @@
<!doctype html>
<html>
<head>
<title>Test for Bug 854082</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<base href="chrome://browser/content/">
</head>
<body>
<script type="application/javascript">
// Tests that destroying the plugin's frame inside NPP_New does not cause a
// crash
SimpleTest.waitForExplicitFinish();
// Create an object that will spawn asynchronously
var o = document.createElement("object");
o.type = "application/x-test";
// The test plugin sets pluginFoundElement on its element inside NPP_New,
// abuse this to run arbitrary script.
var setterCalled;
o.__defineSetter__("pluginFoundElement", function() {
o.style.display = "none";
// Access clientTop to force layout flush
o.clientTop;
setterCalled = true;
});
document.body.appendChild(o);
SimpleTest.executeSoon(function() {
ok(setterCalled, "Setter called and did not crash");
SimpleTest.finish();
});
</script>
</body>
</html>

15
layout/generic/nsObjectFrame.cpp
Просмотреть файл

@ -308,19 +308,14 @@ nsObjectFrame::DestroyFrom(nsIFrame* aDestructRoot)
// Tell content owner of the instance to disconnect its frame. // Tell content owner of the instance to disconnect its frame.
nsCOMPtr<nsIObjectLoadingContent> objContent(do_QueryInterface(mContent)); nsCOMPtr<nsIObjectLoadingContent> objContent(do_QueryInterface(mContent));
NS_ASSERTION(objContent, "Why not an object loading content?"); NS_ASSERTION(objContent, "Why not an object loading content?");
// The content might not have a reference to the instance owner any longer in
// the case of re-entry during instantiation or teardown, so make sure we're
// dissociated.
if (mInstanceOwner) {
mInstanceOwner->SetFrame(nullptr);
}
objContent->HasNewFrame(nullptr); objContent->HasNewFrame(nullptr);
if (mBackgroundSink) { if (mBackgroundSink) {
mBackgroundSink->Destroy(); mBackgroundSink->Destroy();
} }
SetInstanceOwner(nullptr);
nsObjectFrameSuper::DestroyFrom(aDestructRoot); nsObjectFrameSuper::DestroyFrom(aDestructRoot);
} }
@ -780,10 +775,6 @@ nsObjectFrame::UnregisterPluginForGeometryUpdates()
void void
nsObjectFrame::SetInstanceOwner(nsPluginInstanceOwner* aOwner) nsObjectFrame::SetInstanceOwner(nsPluginInstanceOwner* aOwner)
{ {
// The ownership model here is historically fuzzy. This should only be called
// by nsPluginInstanceOwner when it is given a new frame, and
// nsObjectLoadingContent should be arbitrating frame-ownership via its
// HasNewFrame callback.
mInstanceOwner = aOwner; mInstanceOwner = aOwner;
if (mInstanceOwner) { if (mInstanceOwner) {
return; return;
@ -883,7 +874,7 @@ nsObjectFrame::DidReflow(nsPresContext* aPresContext,
// The view is created hidden; once we have reflowed it and it has been // The view is created hidden; once we have reflowed it and it has been
// positioned then we show it. // positioned then we show it.
if (aStatus != nsDidReflowStatus::FINISHED) if (aStatus != nsDidReflowStatus::FINISHED)
return rv; return rv;
if (HasView()) { if (HasView()) {