зеркало из https://github.com/mozilla/gecko-dev.git
Backout e3eaea876a18, 3aaf738a04d8, and 43d1b14e8920 (Bug 854082) for orange on a CLOSED TREE
This commit is contained in:
John Schoenick
Родитель
4514ee2bc1
Коммит
1318029be2
|
|
@ -799,14 +799,6 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
|
|||
|
||||
mInstanceOwner = newOwner;
|
||||
|
||||
// Ensure the frame did not change during instantiation re-entry (common).
|
||||
// HasNewFrame would not have mInstanceOwner yet, so the new frame would be
|
||||
// dangling. (Bug 854082)
|
||||
nsIFrame* frame = thisContent->GetPrimaryFrame();
|
||||
if (frame && mInstanceOwner) {
|
||||
mInstanceOwner->SetFrame(static_cast<nsObjectFrame*>(frame));
|
||||
}
|
||||
|
||||
// Set up scripting interfaces.
|
||||
NotifyContentObjectWrapper();
|
||||
|
||||
|
|
@ -1039,10 +1031,16 @@ nsObjectLoadingContent::HasNewFrame(nsIObjectFrame* aFrame)
|
|||
}
|
||||
|
||||
// Otherwise, we're just changing frames
|
||||
mInstanceOwner->SetFrame(nullptr);
|
||||
|
||||
// Set up relationship between instance owner and frame.
|
||||
nsObjectFrame *objFrame = static_cast<nsObjectFrame*>(aFrame);
|
||||
mInstanceOwner->SetFrame(objFrame);
|
||||
|
||||
// Set up new frame to draw.
|
||||
objFrame->FixupWindow(objFrame->GetContentRectRelativeToSelf().Size());
|
||||
objFrame->InvalidateFrame();
|
||||
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
|
|
@ -2320,6 +2318,7 @@ nsObjectLoadingContent::PluginDestroyed()
|
|||
// plugins in plugin host. Invalidate instance owner / prototype but otherwise
|
||||
// don't take any action.
|
||||
TeardownProtoChain();
|
||||
mInstanceOwner->SetFrame(nullptr);
|
||||
mInstanceOwner->Destroy();
|
||||
mInstanceOwner = nullptr;
|
||||
return NS_OK;
|
||||
|
|
@ -2603,8 +2602,6 @@ nsObjectLoadingContent::StopPluginInstance()
|
|||
CloseChannel();
|
||||
}
|
||||
|
||||
// We detach the instance owner's frame before destruction, but don't destroy
|
||||
// the instance owner until the plugin is stopped.
|
||||
mInstanceOwner->SetFrame(nullptr);
|
||||
|
||||
bool delayedStop = false;
|
||||
|
|
|
|||
|
|
@ -2504,7 +2504,8 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
|
|||
nsresult
|
||||
nsPluginInstanceOwner::Destroy()
|
||||
{
|
||||
SetFrame(nullptr);
|
||||
if (mObjectFrame)
|
||||
mObjectFrame->SetInstanceOwner(nullptr);
|
||||
|
||||
#ifdef XP_MACOSX
|
||||
RemoveFromCARefreshTimer();
|
||||
|
|
|
|||
|
|
@ -67,7 +67,6 @@ MOCHITEST_FILES = \
|
|||
test_bug751809.html \
|
||||
test_bug813906.html \
|
||||
test_bug784131.html \
|
||||
test_bug854082.html \
|
||||
test_bug863792.html \
|
||||
file_bug863792.html \
|
||||
test_enumerate.html \
|
||||
|
|
|
|||
|
|
@ -1,39 +0,0 @@
|
|||
<!doctype html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Test for Bug 854082</title>
|
||||
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8">
|
||||
<base href="chrome://browser/content/">
|
||||
</head>
|
||||
<body>
|
||||
<script type="application/javascript">
|
||||
// Tests that destroying the plugin's frame inside NPP_New does not cause a
|
||||
// crash
|
||||
|
||||
SimpleTest.waitForExplicitFinish();
|
||||
|
||||
// Create an object that will spawn asynchronously
|
||||
var o = document.createElement("object");
|
||||
o.type = "application/x-test";
|
||||
|
||||
// The test plugin sets pluginFoundElement on its element inside NPP_New,
|
||||
// abuse this to run arbitrary script.
|
||||
var setterCalled;
|
||||
o.__defineSetter__("pluginFoundElement", function() {
|
||||
o.style.display = "none";
|
||||
// Access clientTop to force layout flush
|
||||
o.clientTop;
|
||||
setterCalled = true;
|
||||
});
|
||||
document.body.appendChild(o);
|
||||
|
||||
SimpleTest.executeSoon(function() {
|
||||
ok(setterCalled, "Setter called and did not crash");
|
||||
SimpleTest.finish();
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -308,19 +308,14 @@ nsObjectFrame::DestroyFrom(nsIFrame* aDestructRoot)
|
|||
// Tell content owner of the instance to disconnect its frame.
|
||||
nsCOMPtr<nsIObjectLoadingContent> objContent(do_QueryInterface(mContent));
|
||||
NS_ASSERTION(objContent, "Why not an object loading content?");
|
||||
|
||||
// The content might not have a reference to the instance owner any longer in
|
||||
// the case of re-entry during instantiation or teardown, so make sure we're
|
||||
// dissociated.
|
||||
if (mInstanceOwner) {
|
||||
mInstanceOwner->SetFrame(nullptr);
|
||||
}
|
||||
objContent->HasNewFrame(nullptr);
|
||||
|
||||
if (mBackgroundSink) {
|
||||
mBackgroundSink->Destroy();
|
||||
}
|
||||
|
||||
SetInstanceOwner(nullptr);
|
||||
|
||||
nsObjectFrameSuper::DestroyFrom(aDestructRoot);
|
||||
}
|
||||
|
||||
|
|
@ -780,10 +775,6 @@ nsObjectFrame::UnregisterPluginForGeometryUpdates()
|
|||
void
|
||||
nsObjectFrame::SetInstanceOwner(nsPluginInstanceOwner* aOwner)
|
||||
{
|
||||
// The ownership model here is historically fuzzy. This should only be called
|
||||
// by nsPluginInstanceOwner when it is given a new frame, and
|
||||
// nsObjectLoadingContent should be arbitrating frame-ownership via its
|
||||
// HasNewFrame callback.
|
||||
mInstanceOwner = aOwner;
|
||||
if (mInstanceOwner) {
|
||||
return;
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче