From b30e208aa55b440c76301c16ede0abebb9a6f34a Mon Sep 17 00:00:00 2001
From: Benjamin Smedberg <benjamin@smedbergs.us>
Date: Wed, 23 Sep 2009 19:00:23 -0400
Subject: [PATCH] More plugin crash fixes: failure from NPP_Write doesn't
 actually destroy the stream, it just tells the browser to destroy the stream.
 NPP_NewStream resulting from NPN_GetURLNotify didn't have the notifyData
 field set correctly. Other minor logging and cleanup.

--HG--
extra : rebase_source : 932c0290a7c1779275266607d5e853d5c1994396
---
 dom/plugins/BrowserStreamChild.cpp  |  8 +++++---
 dom/plugins/BrowserStreamChild.h    |  2 ++
 dom/plugins/BrowserStreamParent.cpp | 11 +++++++----
 dom/plugins/BrowserStreamParent.h   |  2 +-
 dom/plugins/PluginInstanceChild.cpp |  4 ++--
 dom/plugins/StreamNotifyChild.h     |  1 +
 6 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/dom/plugins/BrowserStreamChild.cpp b/dom/plugins/BrowserStreamChild.cpp
index 23506929a628..f1a06dcc676b 100644
--- a/dom/plugins/BrowserStreamChild.cpp
+++ b/dom/plugins/BrowserStreamChild.cpp
@@ -37,6 +37,7 @@
 
 #include "BrowserStreamChild.h"
 #include "PluginInstanceChild.h"
+#include "StreamNotifyChild.h"
 
 namespace mozilla {
 namespace plugins {
@@ -45,6 +46,7 @@ BrowserStreamChild::BrowserStreamChild(PluginInstanceChild* instance,
                                        const nsCString& url,
                                        const uint32_t& length,
                                        const uint32_t& lastmodified,
+                                       const PStreamNotifyChild* notifyData,
                                        const nsCString& headers,
                                        const nsCString& mimeType,
                                        const bool& seekable,
@@ -61,6 +63,9 @@ BrowserStreamChild::BrowserStreamChild(PluginInstanceChild* instance,
     mStream.url = mURL.get();
   mStream.end = length;
   mStream.lastmodified = lastmodified;
+  if (notifyData)
+    mStream.notifyData =
+      static_cast<const StreamNotifyChild*>(notifyData)->mClosure;
   if (!mHeaders.IsEmpty())
     mStream.headers = mHeaders.get();
 
@@ -99,9 +104,6 @@ BrowserStreamChild::AnswerNPP_Write(const int32_t& offset,
   *consumed = mInstance->mPluginIface->write(&mInstance->mData, &mStream,
                                              offset, data.Length(),
                                              const_cast<char*>(data.get()));
-  if (*consumed < 0)
-    mClosed = true;
-
   return true;
 }
 
diff --git a/dom/plugins/BrowserStreamChild.h b/dom/plugins/BrowserStreamChild.h
index 794712199fbd..f7ce12ac124d 100644
--- a/dom/plugins/BrowserStreamChild.h
+++ b/dom/plugins/BrowserStreamChild.h
@@ -45,6 +45,7 @@ namespace mozilla {
 namespace plugins {
 
 class PluginInstanceChild;
+class PStreamNotifyChild;
 
 class BrowserStreamChild : public PBrowserStreamChild, public AStream
 {
@@ -53,6 +54,7 @@ public:
                      const nsCString& url,
                      const uint32_t& length,
                      const uint32_t& lastmodified,
+                     const PStreamNotifyChild* notifyData,
                      const nsCString& headers,
                      const nsCString& mimeType,
                      const bool& seekable,
diff --git a/dom/plugins/BrowserStreamParent.cpp b/dom/plugins/BrowserStreamParent.cpp
index aea2e86f5261..575f9b14268c 100644
--- a/dom/plugins/BrowserStreamParent.cpp
+++ b/dom/plugins/BrowserStreamParent.cpp
@@ -11,9 +11,15 @@ BrowserStreamParent::BrowserStreamParent(PluginInstanceParent* npp,
   : mNPP(npp)
   , mStream(stream)
 {
+  printf("BrowserStreamParent::BrowserStreamParent<%p>\n", (void*) this);
   mStream->pdata = static_cast<AStream*>(this);
 }
 
+BrowserStreamParent::~BrowserStreamParent()
+{
+  printf("BrowserStreamParent::~BrowserStreamParent<%p>\n", (void*) this);
+}  
+
 bool
 BrowserStreamParent::AnswerNPN_RequestRead(const IPCByteRanges& ranges,
                                            NPError* result)
@@ -64,12 +70,9 @@ BrowserStreamParent::Write(int32_t offset,
   int32_t result;
   if (!CallNPP_Write(offset,
                      nsCString(static_cast<char*>(buffer), len),
-                     &result)) {
+                     &result))
     return -1;
-  }
 
-  if (result == -1)
-    mNPP->CallPBrowserStreamDestructor(this, NPRES_USER_BREAK, true);
   return result;
 }
 
diff --git a/dom/plugins/BrowserStreamParent.h b/dom/plugins/BrowserStreamParent.h
index cf18e909565c..8a3e05db5c36 100644
--- a/dom/plugins/BrowserStreamParent.h
+++ b/dom/plugins/BrowserStreamParent.h
@@ -54,7 +54,7 @@ class BrowserStreamParent : public PBrowserStreamParent, public AStream
 public:
   BrowserStreamParent(PluginInstanceParent* npp,
                       NPStream* stream);
-  virtual ~BrowserStreamParent() { }
+  virtual ~BrowserStreamParent();
 
   NS_OVERRIDE virtual bool IsBrowserStream() { return true; }
 
diff --git a/dom/plugins/PluginInstanceChild.cpp b/dom/plugins/PluginInstanceChild.cpp
index 4c790ff6197c..a724e6cbc3aa 100644
--- a/dom/plugins/PluginInstanceChild.cpp
+++ b/dom/plugins/PluginInstanceChild.cpp
@@ -462,8 +462,8 @@ PluginInstanceChild::AllocPBrowserStream(const nsCString& url,
                                          NPError* rv,
                                          uint16_t *stype)
 {
-    return new BrowserStreamChild(this, url, length, lastmodified, headers,
-                                  mimeType, seekable, rv, stype);
+    return new BrowserStreamChild(this, url, length, lastmodified, notifyData,
+                                  headers, mimeType, seekable, rv, stype);
 }
 
 bool
diff --git a/dom/plugins/StreamNotifyChild.h b/dom/plugins/StreamNotifyChild.h
index e875a809af09..935f9144c17d 100644
--- a/dom/plugins/StreamNotifyChild.h
+++ b/dom/plugins/StreamNotifyChild.h
@@ -47,6 +47,7 @@ namespace plugins {
 class StreamNotifyChild : public PStreamNotifyChild
 {
   friend class PluginInstanceChild;
+  friend class BrowserStreamChild;
 
 public:
   StreamNotifyChild(const nsCString& aURL, void* aClosure)