From f9f95c59d45a51df27c70b824ff7b82ec7aee852 Mon Sep 17 00:00:00 2001 From: Benoit Girard Date: Wed, 10 Aug 2016 16:21:01 -0400 Subject: [PATCH] Bug 1264530 - Hold on to Plugin Instance to survive frame poisoning. r=jimm MozReview-Commit-ID: JHbce46rDBN --- layout/generic/nsPluginFrame.cpp | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/layout/generic/nsPluginFrame.cpp b/layout/generic/nsPluginFrame.cpp index 6a5a55ef1d45..b54b320c1988 100644 --- a/layout/generic/nsPluginFrame.cpp +++ b/layout/generic/nsPluginFrame.cpp @@ -642,7 +642,7 @@ nsPluginFrame::CallSetWindow(bool aCheckIsHidden) // window must be in "display pixels" double scaleFactor = 1.0; - if (NS_FAILED(mInstanceOwner->GetContentsScaleFactor(&scaleFactor))) { + if (NS_FAILED(instanceOwnerRef->GetContentsScaleFactor(&scaleFactor))) { scaleFactor = 1.0; } size_t intScaleFactor = ceil(scaleFactor); @@ -651,12 +651,15 @@ nsPluginFrame::CallSetWindow(bool aCheckIsHidden) window->width = intBounds.width / intScaleFactor; window->height = intBounds.height / intScaleFactor; - mInstanceOwner->ResolutionMayHaveChanged(); + // BE CAREFUL: By the time we get here the PluginFrame is sometimes destroyed + // and poisoned. If we reference local fields (implicit this deref), + // we will crash. + instanceOwnerRef->ResolutionMayHaveChanged(); // This will call pi->SetWindow and take care of window subclassing // if needed, see bug 132759. Calling SetWindow can destroy this frame // so check for that before doing anything else with this frame's memory. - if (mInstanceOwner->UseAsyncRendering()) { + if (instanceOwnerRef->UseAsyncRendering()) { rv = pi->AsyncSetWindow(window); } else {