Fix for crash when object frame goes away but stream is still going bug 99569 r=av sr=attinasi

layout/generic/nsObjectFrame.cpp

@@ -3256,6 +3256,9 @@ nsPluginInstanceOwner::Destroy()
     else NS_ASSERTION(PR_FALSE, "plugin was not an event listener");
   }
   else NS_ASSERTION(PR_FALSE, "plugin had no content");
+
+  mOwner = nsnull; // break relationship between frame and plugin instance owner
+
   return NS_OK;
 }
 

layout/html/base/src/nsObjectFrame.cpp

@@ -3256,6 +3256,9 @@ nsPluginInstanceOwner::Destroy()
     else NS_ASSERTION(PR_FALSE, "plugin was not an event listener");
   }
   else NS_ASSERTION(PR_FALSE, "plugin had no content");
+
+  mOwner = nsnull; // break relationship between frame and plugin instance owner
+
   return NS_OK;
 }
 

modules/plugin/base/src/nsPluginHostImpl.cpp

@@ -1783,10 +1783,19 @@ nsPluginStreamListenerPeer::OnStartRequest(nsIRequest *request, nsISupports* aCo
 
   mHaveFiredOnStartRequest = PR_TRUE;
 
-  nsCOMPtr<nsIChannel> channel = do_QueryInterface(request);
+  // do a little sanity check to make sure our frame isn't gone
+  // by getting the tag type and checking for an error, we can determine if
+  // the frame is gone
+  if (mOwner) {
+    nsCOMPtr<nsIPluginTagInfo2> pti2 = do_QueryInterface(mOwner);
+    NS_ENSURE_TRUE(pti2, NS_ERROR_FAILURE);
+    nsPluginTagType tagType;  
+    if (NS_FAILED(pti2->GetTagType(&tagType)))
+      return NS_ERROR_FAILURE;  // something happened to our object frame, so bail!
+  }
 
-  if (!channel)
-      return NS_ERROR_FAILURE;
+  nsCOMPtr<nsIChannel> channel = do_QueryInterface(request);
+  NS_ENSURE_TRUE(channel, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsICachingChannel> cacheChannel = do_QueryInterface(channel, &rv);
   if (cacheChannel)