From 62d0a74217f1ccba6ca0685fe72f67f82d9b62aa Mon Sep 17 00:00:00 2001
From: "av%netscape.com" <av%netscape.com>
Date: Fri, 17 Aug 2001 00:45:25 +0000
Subject: [PATCH] Fix for 89672 -- topembed, crash on exit with xpcom plugin,
 r=peterl, sr=waterson

---
 layout/generic/nsObjectFrame.cpp              | 13 ++++---
 layout/html/base/src/nsObjectFrame.cpp        | 13 ++++---
 .../plugin/base/src/nsPluginInstancePeer.cpp  | 11 +++---
 modules/plugin/base/src/nsPluginViewer.cpp    | 34 ++++++++-----------
 4 files changed, 33 insertions(+), 38 deletions(-)

diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
index b4e6f6963d5..22d42fa3b6e 100644
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -602,6 +602,11 @@ nsObjectFrame::Destroy(nsIPresContext* aPresContext)
         inst->SetWindow(nsnull);
         inst->Stop();
       }
+
+      nsCOMPtr<nsIPluginHost> pluginHost = do_GetService(kCPluginManagerCID);
+      if(pluginHost)
+        pluginHost->StopPluginInstance(inst);
+
       NS_RELEASE(inst);
     }
   }
@@ -1716,13 +1721,7 @@ nsPluginInstanceOwner::~nsPluginInstanceOwner()
     CancelTimer();
   }
 
-  if (nsnull != mInstance)
-  {
-    if (mPluginHost)
-      mPluginHost->StopPluginInstance(mInstance);
-    NS_IF_RELEASE(mInstance);
-  }
-
+  NS_IF_RELEASE(mInstance);
   NS_IF_RELEASE(mPluginHost);
   mOwner = nsnull;
 
diff --git a/layout/html/base/src/nsObjectFrame.cpp b/layout/html/base/src/nsObjectFrame.cpp
index b4e6f6963d5..22d42fa3b6e 100644
--- a/layout/html/base/src/nsObjectFrame.cpp
+++ b/layout/html/base/src/nsObjectFrame.cpp
@@ -602,6 +602,11 @@ nsObjectFrame::Destroy(nsIPresContext* aPresContext)
         inst->SetWindow(nsnull);
         inst->Stop();
       }
+
+      nsCOMPtr<nsIPluginHost> pluginHost = do_GetService(kCPluginManagerCID);
+      if(pluginHost)
+        pluginHost->StopPluginInstance(inst);
+
       NS_RELEASE(inst);
     }
   }
@@ -1716,13 +1721,7 @@ nsPluginInstanceOwner::~nsPluginInstanceOwner()
     CancelTimer();
   }
 
-  if (nsnull != mInstance)
-  {
-    if (mPluginHost)
-      mPluginHost->StopPluginInstance(mInstance);
-    NS_IF_RELEASE(mInstance);
-  }
-
+  NS_IF_RELEASE(mInstance);
   NS_IF_RELEASE(mPluginHost);
   mOwner = nsnull;
 
diff --git a/modules/plugin/base/src/nsPluginInstancePeer.cpp b/modules/plugin/base/src/nsPluginInstancePeer.cpp
index e516ce2fe81..651ed469fbd 100644
--- a/modules/plugin/base/src/nsPluginInstancePeer.cpp
+++ b/modules/plugin/base/src/nsPluginInstancePeer.cpp
@@ -56,7 +56,7 @@ nsPluginInstancePeerImpl::nsPluginInstancePeerImpl()
 nsPluginInstancePeerImpl::~nsPluginInstancePeerImpl()
 {
   mInstance = nsnull;
-  mOwner = nsnull;
+  NS_IF_RELEASE(mOwner);
 
   if (nsnull != mMIMEType)
   {
@@ -896,11 +896,10 @@ NS_IMETHODIMP nsPluginInstancePeerImpl::GetJSContext(JSContext* *outContext)
 nsresult nsPluginInstancePeerImpl::Initialize(nsIPluginInstanceOwner *aOwner,
                                                 const nsMIMEType aMIMEType)
 {
-  //don't add a ref to prevent circular references... MMP
   mOwner = aOwner;
+  NS_IF_ADDREF(mOwner);
 
   aOwner->GetInstance(mInstance);
-  //release this one too... MMP
   NS_IF_RELEASE(mInstance);
 
   if (nsnull != aMIMEType)
@@ -919,8 +918,12 @@ nsresult nsPluginInstancePeerImpl::Initialize(nsIPluginInstanceOwner *aOwner,
 
 nsresult nsPluginInstancePeerImpl::SetOwner(nsIPluginInstanceOwner *aOwner)
 {
-  // do not add refs to these objects to prevent circular references
+  // get rid of the previous owner
+  NS_IF_RELEASE(mOwner);
+
   mOwner = aOwner;
+  NS_IF_ADDREF(mOwner);
+
   aOwner->GetInstance(mInstance);
   NS_IF_RELEASE(mInstance);
   return NS_OK;
diff --git a/modules/plugin/base/src/nsPluginViewer.cpp b/modules/plugin/base/src/nsPluginViewer.cpp
index 6873cbe5de1..bedc825d5a3 100644
--- a/modules/plugin/base/src/nsPluginViewer.cpp
+++ b/modules/plugin/base/src/nsPluginViewer.cpp
@@ -254,6 +254,19 @@ PluginViewerImpl::~PluginViewerImpl()
   if (mOwner) mOwner->CancelTimer();
 #endif
 
+  if(mOwner) {
+    nsIPluginInstance * inst;
+    mOwner->GetInstance(inst);
+
+    if(inst) {
+      nsCOMPtr<nsIPluginHost> host = do_GetService(kCPluginManagerCID);
+      if(host)
+        host->StopPluginInstance(inst);
+      
+      NS_RELEASE(inst);
+    }
+  }
+
   NS_IF_RELEASE(mOwner);
   if (nsnull != mWindow) {
     mWindow->Destroy();
@@ -913,26 +926,7 @@ pluginInstanceOwner :: ~pluginInstanceOwner()
     CancelTimer();
   }
 
-  if (nsnull != mInstance)
-  {
-    PRBool doCache = PR_TRUE;
-    
-    // determine if the plugin wants to be cached
-    mInstance->GetValue(nsPluginInstanceVariable_DoCacheBool, 
-                        (void *) &doCache);
-    mInstance->Stop();
-    if (!doCache) {
-      // if not, destroy the instance
-      mInstance->Destroy();
-    }
-    else {
-      nsCOMPtr<nsIPluginHost> host;
-      host = do_GetService(kCPluginManagerCID);
-      if(host)
-        host->StopPluginInstance(mInstance);
-    }
-    NS_IF_RELEASE(mInstance);
-  }
+  NS_IF_RELEASE(mInstance);
 
   mWindow = nsnull;
   mViewer = nsnull;