Fix for 89672 -- topembed, crash on exit with xpcom plugin, r=peterl, sr=waterson

layout/generic/nsObjectFrame.cpp

@@ -602,6 +602,11 @@ nsObjectFrame::Destroy(nsIPresContext* aPresContext)
         inst->SetWindow(nsnull);
         inst->Stop();
       }
+
+      nsCOMPtr<nsIPluginHost> pluginHost = do_GetService(kCPluginManagerCID);
+      if(pluginHost)
+        pluginHost->StopPluginInstance(inst);
+
       NS_RELEASE(inst);
     }
   }
@@ -1716,13 +1721,7 @@ nsPluginInstanceOwner::~nsPluginInstanceOwner()
     CancelTimer();
   }
 
-  if (nsnull != mInstance)
-  {
-    if (mPluginHost)
-      mPluginHost->StopPluginInstance(mInstance);
-    NS_IF_RELEASE(mInstance);
-  }
-
+  NS_IF_RELEASE(mInstance);
   NS_IF_RELEASE(mPluginHost);
   mOwner = nsnull;
 

layout/html/base/src/nsObjectFrame.cpp

@@ -602,6 +602,11 @@ nsObjectFrame::Destroy(nsIPresContext* aPresContext)
         inst->SetWindow(nsnull);
         inst->Stop();
       }
+
+      nsCOMPtr<nsIPluginHost> pluginHost = do_GetService(kCPluginManagerCID);
+      if(pluginHost)
+        pluginHost->StopPluginInstance(inst);
+
       NS_RELEASE(inst);
     }
   }
@@ -1716,13 +1721,7 @@ nsPluginInstanceOwner::~nsPluginInstanceOwner()
     CancelTimer();
   }
 
-  if (nsnull != mInstance)
-  {
-    if (mPluginHost)
-      mPluginHost->StopPluginInstance(mInstance);
-    NS_IF_RELEASE(mInstance);
-  }
-
+  NS_IF_RELEASE(mInstance);
   NS_IF_RELEASE(mPluginHost);
   mOwner = nsnull;
 

modules/plugin/base/src/nsPluginInstancePeer.cpp

@@ -56,7 +56,7 @@ nsPluginInstancePeerImpl::nsPluginInstancePeerImpl()
 nsPluginInstancePeerImpl::~nsPluginInstancePeerImpl()
 {
   mInstance = nsnull;
-  mOwner = nsnull;
+  NS_IF_RELEASE(mOwner);
 
   if (nsnull != mMIMEType)
   {
@@ -896,11 +896,10 @@ NS_IMETHODIMP nsPluginInstancePeerImpl::GetJSContext(JSContext* *outContext)
 nsresult nsPluginInstancePeerImpl::Initialize(nsIPluginInstanceOwner *aOwner,
                                                 const nsMIMEType aMIMEType)
 {
-  //don't add a ref to prevent circular references... MMP
   mOwner = aOwner;
+  NS_IF_ADDREF(mOwner);
 
   aOwner->GetInstance(mInstance);
-  //release this one too... MMP
   NS_IF_RELEASE(mInstance);
 
   if (nsnull != aMIMEType)
@@ -919,8 +918,12 @@ nsresult nsPluginInstancePeerImpl::Initialize(nsIPluginInstanceOwner *aOwner,
 
 nsresult nsPluginInstancePeerImpl::SetOwner(nsIPluginInstanceOwner *aOwner)
 {
-  // do not add refs to these objects to prevent circular references
+  // get rid of the previous owner
+  NS_IF_RELEASE(mOwner);
+
   mOwner = aOwner;
+  NS_IF_ADDREF(mOwner);
+
   aOwner->GetInstance(mInstance);
   NS_IF_RELEASE(mInstance);
   return NS_OK;

modules/plugin/base/src/nsPluginViewer.cpp

@@ -254,6 +254,19 @@ PluginViewerImpl::~PluginViewerImpl()
   if (mOwner) mOwner->CancelTimer();
 #endif
 
+  if(mOwner) {
+    nsIPluginInstance * inst;
+    mOwner->GetInstance(inst);
+
+    if(inst) {
+      nsCOMPtr<nsIPluginHost> host = do_GetService(kCPluginManagerCID);
+      if(host)
+        host->StopPluginInstance(inst);
+      
+      NS_RELEASE(inst);
+    }
+  }
+
   NS_IF_RELEASE(mOwner);
   if (nsnull != mWindow) {
     mWindow->Destroy();
@@ -913,26 +926,7 @@ pluginInstanceOwner :: ~pluginInstanceOwner()
     CancelTimer();
   }
 
-  if (nsnull != mInstance)
-  {
-    PRBool doCache = PR_TRUE;
-    
-    // determine if the plugin wants to be cached
-    mInstance->GetValue(nsPluginInstanceVariable_DoCacheBool, 
-                        (void *) &doCache);
-    mInstance->Stop();
-    if (!doCache) {
-      // if not, destroy the instance
-      mInstance->Destroy();
-    }
-    else {
-      nsCOMPtr<nsIPluginHost> host;
-      host = do_GetService(kCPluginManagerCID);
-      if(host)
-        host->StopPluginInstance(mInstance);
-    }
-    NS_IF_RELEASE(mInstance);
-  }
+  NS_IF_RELEASE(mInstance);
 
   mWindow = nsnull;
   mViewer = nsnull;