Bug 776331 - Avoid crash when trying to redraw a destroyed plugin on Android r=josh

dom/plugins/base/nsNPAPIPluginInstance.cpp

@@ -218,11 +218,15 @@ nsNPAPIPluginInstance::Destroy()
   mPlugin = nsnull;
 
 #if MOZ_WIDGET_ANDROID
+  if (mContentSurface)
+    mContentSurface->SetFrameAvailableCallback(nsnull);
+  
   mContentTexture = nsnull;
   mContentSurface = nsnull;
 
   std::map<void*, VideoInfo*>::iterator it;
   for (it = mVideos.begin(); it != mVideos.end(); it++) {
+    it->second->mSurfaceTexture->SetFrameAvailableCallback(nsnull);
     delete it->second;
   }
   mVideos.clear();
@@ -988,11 +992,17 @@ nsSurfaceTexture* nsNPAPIPluginInstance::CreateSurfaceTexture()
   if (!surface)
     return nsnull;
 
-  nsCOMPtr<nsIRunnable> frameCallback = NS_NewRunnableMethod(this, &nsNPAPIPluginInstance::RedrawPlugin);
+  nsCOMPtr<nsIRunnable> frameCallback = NS_NewRunnableMethod(this, &nsNPAPIPluginInstance::OnSurfaceTextureFrameAvailable);
   surface->SetFrameAvailableCallback(frameCallback);
   return surface;
 }
 
+void nsNPAPIPluginInstance::OnSurfaceTextureFrameAvailable()
+{
+  if (mRunning == RUNNING && mOwner)
+    RedrawPlugin();
+}
+
 void* nsNPAPIPluginInstance::AcquireContentWindow()
 {
   if (!mContentSurface) {

dom/plugins/base/nsNPAPIPluginInstance.h

@@ -286,6 +286,7 @@ protected:
 
   nsTArray<nsCOMPtr<PluginEventRunnable>> mPostedEvents;
   void PopPostedEvent(PluginEventRunnable* r);
+  void OnSurfaceTextureFrameAvailable();
 
   PRUint32 mFullScreenOrientation;
   bool mWakeLocked;

gfx/thebes/nsSurfaceTexture.h

@@ -44,6 +44,8 @@ public:
   bool GetTransformMatrix(gfx3DMatrix& aMatrix);
   int ID() { return mID; }
 
+  // The callback is guaranteed to be called on the main thread even
+  // if the upstream callback is received on a different thread
   void SetFrameAvailableCallback(nsIRunnable* aRunnable);
 
   // Only should be called by AndroidJNI when we get a