Bug 1155503: BrowserStreamParent should null out its NPStream pointer and we should check for it; r=jimm
authorAaron Klotz <aklotz@mozilla.com>
Mon, 20 Apr 2015 17:04:33 -0600
changeset 240397 815511fdfea637294e016b9d5b643335a8caec92
parent 240396 b49502604e7c14b1accfd91288c136eb5c977944
child 240398 6d5fc5e36c7b13779405e6ee8c70e37ea68a2b48
push id28636
push userkwierso@gmail.com
push dateThu, 23 Apr 2015 00:16:12 +0000
treeherdermozilla-central@a5af73b32ac8 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjimm
bugs1155503
milestone40.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1155503: BrowserStreamParent should null out its NPStream pointer and we should check for it; r=jimm
dom/plugins/ipc/BrowserStreamParent.cpp
dom/plugins/ipc/PluginInstanceParent.cpp
--- a/dom/plugins/ipc/BrowserStreamParent.cpp
+++ b/dom/plugins/ipc/BrowserStreamParent.cpp
@@ -30,46 +30,46 @@ BrowserStreamParent::BrowserStreamParent
     reinterpret_cast<nsNPAPIStreamWrapper*>(mStream->ndata);
   if (wrapper) {
     mStreamListener = wrapper->GetStreamListener();
   }
 }
 
 BrowserStreamParent::~BrowserStreamParent()
 {
+  mStream->pdata = nullptr;
 }
 
 void
 BrowserStreamParent::ActorDestroy(ActorDestroyReason aWhy)
 {
   // Implement me! Bug 1005159
 }
 
 bool
 BrowserStreamParent::RecvAsyncNPP_NewStreamResult(const NPError& rv,
                                                   const uint16_t& stype)
 {
   PLUGIN_LOG_DEBUG_FUNCTION;
   PluginAsyncSurrogate* surrogate = mNPP->GetAsyncSurrogate();
   MOZ_ASSERT(surrogate);
   surrogate->AsyncCallArriving();
-  nsRefPtr<nsNPAPIPluginStreamListener> streamListener = mStreamListener.forget();
   if (mState == DEFERRING_DESTROY) {
     // We've been asked to destroy ourselves before init was complete.
     mState = DYING;
     unused << SendNPP_DestroyStream(mDeferredDestroyReason);
     return true;
   }
 
   NPError error = rv;
   if (error == NPERR_NO_ERROR) {
-    if (!streamListener) {
+    if (!mStreamListener) {
       return false;
     }
-    if (streamListener->SetStreamType(stype)) {
+    if (mStreamListener->SetStreamType(stype)) {
       mState = ALIVE;
     } else {
       error = NPERR_GENERIC_ERROR;
     }
   }
 
   if (error != NPERR_NO_ERROR) {
     surrogate->DestroyAsyncStream(mStream);
--- a/dom/plugins/ipc/PluginInstanceParent.cpp
+++ b/dom/plugins/ipc/PluginInstanceParent.cpp
@@ -1414,16 +1414,22 @@ PluginInstanceParent::NPP_NewStream(NPMI
 
 NPError
 PluginInstanceParent::NPP_DestroyStream(NPStream* stream, NPReason reason)
 {
     PLUGIN_LOG_DEBUG(("%s (stream=%p, reason=%i)",
                       FULLFUNCTION, (void*) stream, (int) reason));
 
     AStream* s = static_cast<AStream*>(stream->pdata);
+    if (!s) {
+        // The stream has already been deleted by other means.
+        // With async plugin init this could happen if async NPP_NewStream
+        // returns an error code.
+        return NPERR_NO_ERROR;
+    }
     if (s->IsBrowserStream()) {
         BrowserStreamParent* sp =
             static_cast<BrowserStreamParent*>(s);
         if (sp->mNPP != this)
             NS_RUNTIMEABORT("Mismatched plugin data");
 
         sp->NPP_DestroyStream(reason);
         return NPERR_NO_ERROR;