зеркало из https://github.com/mozilla/gecko-dev.git
Backout 9423207656dd and d226a39b4181 (Bug 863792) for triggering bug 854082 crashes, the fix for which was backed out. CLOSED TREE
This commit is contained in:
John Schoenick
Родитель
93b18e529b
Коммит
d46a742aeb
|
|
@ -745,8 +745,6 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
|
|||
// Flush layout so that the frame is created if possible and the plugin is
|
||||
// initialized with the latest information.
|
||||
doc->FlushPendingNotifications(Flush_Layout);
|
||||
// Flushing layout may have re-entered and loaded something underneath us
|
||||
NS_ENSURE_TRUE(mInstantiating, NS_OK);
|
||||
|
||||
if (!thisContent->GetPrimaryFrame()) {
|
||||
LOG(("OBJLC [%p]: Not instantiating plugin with no frame", this));
|
||||
|
|
@ -769,36 +767,18 @@ nsObjectLoadingContent::InstantiatePluginInstance(bool aIsLoading)
|
|||
appShell->SuspendNative();
|
||||
}
|
||||
|
||||
nsRefPtr<nsPluginInstanceOwner> newOwner;
|
||||
rv = pluginHost->InstantiatePluginInstance(mContentType.get(),
|
||||
mURI.get(), this,
|
||||
getter_AddRefs(newOwner));
|
||||
getter_AddRefs(mInstanceOwner));
|
||||
|
||||
// XXX(johns): We don't suspend native inside stopping plugins...
|
||||
if (appShell) {
|
||||
appShell->ResumeNative();
|
||||
}
|
||||
|
||||
if (!mInstantiating || NS_FAILED(rv)) {
|
||||
LOG(("OBJLC [%p]: Plugin instantiation failed or re-entered, "
|
||||
"killing old instance", this));
|
||||
// XXX(johns): This needs to be de-duplicated with DoStopPlugin, but we
|
||||
// don't want to touch the protochain or delayed stop.
|
||||
// (Bug 767635)
|
||||
if (newOwner) {
|
||||
nsRefPtr<nsNPAPIPluginInstance> inst;
|
||||
newOwner->GetInstance(getter_AddRefs(inst));
|
||||
newOwner->SetFrame(nullptr);
|
||||
if (inst) {
|
||||
pluginHost->StopPluginInstance(inst);
|
||||
}
|
||||
newOwner->Destroy();
|
||||
}
|
||||
return NS_OK;
|
||||
if (NS_FAILED(rv)) {
|
||||
return rv;
|
||||
}
|
||||
|
||||
mInstanceOwner = newOwner;
|
||||
|
||||
// Set up scripting interfaces.
|
||||
NotifyContentObjectWrapper();
|
||||
|
||||
|
|
@ -2176,10 +2156,6 @@ nsObjectLoadingContent::UnloadObject(bool aResetState)
|
|||
mOriginalContentType.Truncate();
|
||||
}
|
||||
|
||||
// InstantiatePluginInstance checks this after re-entrant calls and aborts if
|
||||
// it was cleared from under it
|
||||
mInstantiating = false;
|
||||
|
||||
mScriptRequested = false;
|
||||
|
||||
// This call should be last as it may re-enter
|
||||
|
|
|
|||
|
|
@ -67,8 +67,6 @@ MOCHITEST_FILES = \
|
|||
test_bug751809.html \
|
||||
test_bug813906.html \
|
||||
test_bug784131.html \
|
||||
test_bug863792.html \
|
||||
file_bug863792.html \
|
||||
test_enumerate.html \
|
||||
test_npruntime_construct.html \
|
||||
307-xo-redirect.sjs \
|
||||
|
|
|
|||
|
|
@ -1,45 +0,0 @@
|
|||
<!doctype html>
|
||||
<html>
|
||||
<head>
|
||||
<title>File for Bug 863792</title>
|
||||
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8">
|
||||
<base href="chrome://browser/content/">
|
||||
</head>
|
||||
<body>
|
||||
<script type="application/javascript">
|
||||
|
||||
// A plugin that removes itself from the document and inactivates said document
|
||||
// inside NPP_New. We should not leak the instance. See also test_bug854082
|
||||
|
||||
var outerwindow = window;
|
||||
var i = document.createElement("iframe");
|
||||
i.width = 500;
|
||||
i.height = 500;
|
||||
var ob = document.body;
|
||||
document.body.appendChild(i);
|
||||
i.addEventListener("load", function loaded() {
|
||||
var id = i.contentDocument;
|
||||
var e = id.createElement("embed");
|
||||
var callbackrun = false;
|
||||
e.width = 200;
|
||||
e.height = 200;
|
||||
e.type = "application/x-test";
|
||||
e.__defineSetter__("pluginFoundElement", function() {
|
||||
window.console.log("pluginFoundElement");
|
||||
e.style.display = "none";
|
||||
e.clientTop;
|
||||
i.removeEventListener("load", loaded);
|
||||
ob.removeChild(i);
|
||||
id.body.clientTop;
|
||||
id.body.removeChild(e);
|
||||
callbackrun = true;
|
||||
});
|
||||
id.body.appendChild(e);
|
||||
e.clientTop;
|
||||
e = id = i = ob = null;
|
||||
SpecialPowers.forceCC(); SpecialPowers.forceGC();
|
||||
}, false);
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
<!doctype html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Test for Bug 863792</title>
|
||||
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
|
||||
<meta http-equiv="content-type" content="text/html; charset=utf-8">
|
||||
</head>
|
||||
<body>
|
||||
<script type="application/javascript">
|
||||
|
||||
// A plugin that removes itself from the document and inactivates said document
|
||||
// inside NPP_New. We should not leak the instance. See also test_bug854082
|
||||
|
||||
SimpleTest.waitForExplicitFinish();
|
||||
|
||||
var i = document.createElement("iframe");
|
||||
i.src = "file_bug863792.html";
|
||||
i.width = 500;
|
||||
i.height = 500;
|
||||
document.body.appendChild(i);
|
||||
|
||||
i.addEventListener("load", function() {
|
||||
SpecialPowers.forceGC();
|
||||
SpecialPowers.forceCC();
|
||||
SimpleTest.executeSoon(function() {
|
||||
SpecialPowers.forceGC();
|
||||
SpecialPowers.forceCC();
|
||||
SimpleTest.executeSoon(function() {
|
||||
ok(true, "Didn't crash");
|
||||
SimpleTest.finish();
|
||||
});
|
||||
});
|
||||
}, false);
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
Загрузка…
Ссылка в новой задаче