From fa70604fdd5818f579dfaaafc5d3407ec9066f2d Mon Sep 17 00:00:00 2001
From: James Willcox <jwillcox@mozilla.com>
Date: Thu, 26 Jul 2012 09:39:21 -0400
Subject: [PATCH] Bug 776331 - Avoid crash when trying to redraw a destroyed
 plugin on Android r=josh

---
 dom/plugins/base/nsNPAPIPluginInstance.cpp | 12 +++++++++++-
 dom/plugins/base/nsNPAPIPluginInstance.h   |  1 +
 gfx/thebes/nsSurfaceTexture.h              |  2 ++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/dom/plugins/base/nsNPAPIPluginInstance.cpp b/dom/plugins/base/nsNPAPIPluginInstance.cpp
index 981b14923bf5..afedd08081ba 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.cpp
+++ b/dom/plugins/base/nsNPAPIPluginInstance.cpp
@@ -218,11 +218,15 @@ nsNPAPIPluginInstance::Destroy()
   mPlugin = nsnull;
 
 #if MOZ_WIDGET_ANDROID
+  if (mContentSurface)
+    mContentSurface->SetFrameAvailableCallback(nsnull);
+  
   mContentTexture = nsnull;
   mContentSurface = nsnull;
 
   std::map<void*, VideoInfo*>::iterator it;
   for (it = mVideos.begin(); it != mVideos.end(); it++) {
+    it->second->mSurfaceTexture->SetFrameAvailableCallback(nsnull);
     delete it->second;
   }
   mVideos.clear();
@@ -988,11 +992,17 @@ nsSurfaceTexture* nsNPAPIPluginInstance::CreateSurfaceTexture()
   if (!surface)
     return nsnull;
 
-  nsCOMPtr<nsIRunnable> frameCallback = NS_NewRunnableMethod(this, &nsNPAPIPluginInstance::RedrawPlugin);
+  nsCOMPtr<nsIRunnable> frameCallback = NS_NewRunnableMethod(this, &nsNPAPIPluginInstance::OnSurfaceTextureFrameAvailable);
   surface->SetFrameAvailableCallback(frameCallback);
   return surface;
 }
 
+void nsNPAPIPluginInstance::OnSurfaceTextureFrameAvailable()
+{
+  if (mRunning == RUNNING && mOwner)
+    RedrawPlugin();
+}
+
 void* nsNPAPIPluginInstance::AcquireContentWindow()
 {
   if (!mContentSurface) {
diff --git a/dom/plugins/base/nsNPAPIPluginInstance.h b/dom/plugins/base/nsNPAPIPluginInstance.h
index 281a03b4d26f..2d184db7cafb 100644
--- a/dom/plugins/base/nsNPAPIPluginInstance.h
+++ b/dom/plugins/base/nsNPAPIPluginInstance.h
@@ -286,6 +286,7 @@ protected:
 
   nsTArray<nsCOMPtr<PluginEventRunnable>> mPostedEvents;
   void PopPostedEvent(PluginEventRunnable* r);
+  void OnSurfaceTextureFrameAvailable();
 
   PRUint32 mFullScreenOrientation;
   bool mWakeLocked;
diff --git a/gfx/thebes/nsSurfaceTexture.h b/gfx/thebes/nsSurfaceTexture.h
index 3d7213589257..4587a94f4340 100644
--- a/gfx/thebes/nsSurfaceTexture.h
+++ b/gfx/thebes/nsSurfaceTexture.h
@@ -44,6 +44,8 @@ public:
   bool GetTransformMatrix(gfx3DMatrix& aMatrix);
   int ID() { return mID; }
 
+  // The callback is guaranteed to be called on the main thread even
+  // if the upstream callback is received on a different thread
   void SetFrameAvailableCallback(nsIRunnable* aRunnable);
 
   // Only should be called by AndroidJNI when we get a