Fix leaky cycle between nsNPAPIPluginInstance and nsPluginInstancePeer. b=472439 r=josh sr=jst

modules/plugin/base/public/nsPluginNativeWindow.h

@@ -46,6 +46,7 @@
 #include "nsIPluginInstance.h"
 #include "nsplugindefs.h"
 #include "nsIWidget.h"
+#include "nsTraceRefcnt.h"
 
 /**
  * base class for native plugin window implementations
@@ -53,8 +54,13 @@
 class nsPluginNativeWindow : public nsPluginWindow
 {
 public: 
-  nsPluginNativeWindow() : nsPluginWindow() {}
-  virtual ~nsPluginNativeWindow() {}
+  nsPluginNativeWindow() : nsPluginWindow() {
+    MOZ_COUNT_CTOR(nsPluginNativeWindow);
+  }
+
+  virtual ~nsPluginNativeWindow() {
+    MOZ_COUNT_DTOR(nsPluginNativeWindow);
+  }
 
   /**
    *   !!! CAUTION !!!

modules/plugin/base/src/nsNPAPIPluginInstance.cpp

@@ -840,8 +840,11 @@ NS_IMETHODIMP nsNPAPIPluginInstance::Stop(void)
     }
   }
 
-  if (!mStarted)
+  if (!mStarted) {
+    // Break our cycle with the peer that owns us.
+    mPeer = nsnull;
     return NS_OK;
+  }
 
   // If there's code from this plugin instance on the stack, delay the
   // destroy.
@@ -857,8 +860,11 @@ NS_IMETHODIMP nsNPAPIPluginInstance::Stop(void)
 
   OnPluginDestroy(&fNPP);
 
-  if (fCallbacks->destroy == NULL)
+  if (fCallbacks->destroy == NULL) {
+    // Break our cycle with the peer that owns us.
+    mPeer = nsnull;
     return NS_ERROR_FAILURE;
+  }
 
   NPSavedData *sdata = 0;
 
@@ -884,6 +890,9 @@ NS_IMETHODIMP nsNPAPIPluginInstance::Stop(void)
 
   nsJSNPRuntime::OnPluginDestroy(&fNPP);
 
+  // Break our cycle with the peer that owns us.
+  mPeer = nsnull;
+
   if (error != NPERR_NO_ERROR)
     return NS_ERROR_FAILURE;
   else

modules/plugin/base/src/nsPluginInstancePeer.cpp

@@ -67,16 +67,11 @@
 
 nsPluginInstancePeerImpl::nsPluginInstancePeerImpl()
 {
-  mInstance = nsnull;
-  mOwner = nsnull;
   mMIMEType = nsnull;
 }
 
 nsPluginInstancePeerImpl::~nsPluginInstancePeerImpl()
 {
-  mInstance = nsnull;
-  NS_IF_RELEASE(mOwner);
-
   if (nsnull != mMIMEType) {
     PR_Free((void *)mMIMEType);
     mMIMEType = nsnull;
@@ -829,10 +824,6 @@ nsPluginInstancePeerImpl::Initialize(nsIPluginInstanceOwner *aOwner,
                                      const nsMIMEType aMIMEType)
 {
   mOwner = aOwner;
-  NS_IF_ADDREF(mOwner);
-
-  aOwner->GetInstance(mInstance);
-  NS_IF_RELEASE(mInstance);
 
   if (nsnull != aMIMEType) {
     mMIMEType = (nsMIMEType)PR_Malloc(PL_strlen(aMIMEType) + 1);
@@ -850,14 +841,7 @@ nsPluginInstancePeerImpl::Initialize(nsIPluginInstanceOwner *aOwner,
 nsresult
 nsPluginInstancePeerImpl::SetOwner(nsIPluginInstanceOwner *aOwner)
 {
-  // get rid of the previous owner
-  NS_IF_RELEASE(mOwner);
-
   mOwner = aOwner;
-  NS_IF_ADDREF(mOwner);
-
-  aOwner->GetInstance(mInstance);
-  NS_IF_RELEASE(mInstance);
   return NS_OK;
 }
 

modules/plugin/base/src/nsPluginInstancePeer.h

@@ -47,6 +47,8 @@
 #endif
 #include "nsPIPluginInstancePeer.h"
 
+#include "nsCOMPtr.h"
+
 class nsPluginInstancePeerImpl : public nsIPluginInstancePeer2,
                                  public nsIWindowlessPluginInstancePeer,
                                  public nsIPluginTagInfo2,
@@ -95,8 +97,7 @@ public:
   nsresult SetOwner(nsIPluginInstanceOwner *aOwner);
 
 private:
-  nsIPluginInstance       *mInstance; //we don't add a ref to this
-  nsIPluginInstanceOwner  *mOwner;    //we don't add a ref to this
+  nsCOMPtr<nsIPluginInstanceOwner> mOwner;
   nsMIMEType              mMIMEType;
   PRUint32                mThreadID;
   PRBool                  mStopped;