Bug 1132874 - Improve protections against sending a parent plugin protocol shutdown message to the child after the child has torn down. r=aklotz

dom/plugins/ipc/PluginWidgetParent.cpp

@@ -70,18 +70,7 @@ PluginWidgetParent::~PluginWidgetParent()
   // A destroy call can actually get skipped if a widget is associated
   // with the last out-of-process page, make sure and cleanup any left
   // over widgets if we have them.
-  if (mWidget) {
-#if defined(MOZ_WIDGET_GTK)
-    mWidget->SetNativeData(NS_NATIVE_PLUGIN_OBJECT_PTR, (uintptr_t)0);
-    mWrapper = nullptr;
-#elif defined(XP_WIN)
-    ::RemovePropW((HWND)mWidget->GetNativeData(NS_NATIVE_WINDOW),
-                  kPluginWidgetParentProperty);
-#endif
-    mWidget->UnregisterPluginWindowForRemoteUpdates();
-    mWidget->Destroy();
-    mWidget = nullptr;
-  }
+  KillWidget();
 }
 
 mozilla::dom::TabParent*
@@ -191,14 +180,30 @@ PluginWidgetParent::RecvCreate(nsresult* aResult)
   return true;
 }
 
+void
+PluginWidgetParent::KillWidget()
+{
+  PWLOG("PluginWidgetParent::KillWidget() widget=%p\n", mWidget);
+  if (mWidget) {
+#if defined(MOZ_WIDGET_GTK)
+    mWidget->SetNativeData(NS_NATIVE_PLUGIN_OBJECT_PTR, (uintptr_t)0);
+    mWrapper = nullptr;
+#elif defined(XP_WIN)
+    ::RemovePropW((HWND)mWidget->GetNativeData(NS_NATIVE_WINDOW),
+                  kPluginWidgetParentProperty);
+#endif
+    mWidget->UnregisterPluginWindowForRemoteUpdates();
+    mWidget->Destroy();
+    mWidget = nullptr;
+  }
+}
+
 void
 PluginWidgetParent::Shutdown(ShutdownType aType)
 {
+  PWLOG("PluginWidgetParent::Shutdown(%s)\n", aType == TAB_CLOSURE ? "TAB_CLOSURE" : "CONTENT");
   if (mWidget) {
-    mWidget->UnregisterPluginWindowForRemoteUpdates();
-    DebugOnly<nsresult> rv = mWidget->Destroy();
-    NS_ASSERTION(NS_SUCCEEDED(rv), "widget destroy failure");
-    mWidget = nullptr;
+    KillWidget();
     unused << SendParentShutdown(aType);
   }
 }
@@ -207,6 +212,7 @@ void
 PluginWidgetParent::ActorDestroy(ActorDestroyReason aWhy)
 {
   PWLOG("PluginWidgetParent::ActorDestroy()\n");
+  KillWidget();
 }
 
 // Called by TabParent's Destroy() in response to an early tear down (Early

dom/plugins/ipc/PluginWidgetParent.h

@@ -63,6 +63,7 @@ public:
 
 private:
   void Shutdown(ShutdownType aType);
+  void KillWidget();
 
   // The chrome side native widget.
   nsCOMPtr<nsIWidget> mWidget;