Bug 1141081 - Ensure nsPluginInstanceOwner::Destroy is called before returning from failed plugin instantiation. r=jimm, a=lmandel
authorAaron Klotz <aklotz@mozilla.com>
Tue, 17 Mar 2015 19:44:34 -0600
changeset 250444 2710769c40a5
parent 250443 968fa2b32612
child 250445 e92558fa59eb
push id4589
push userryanvm@gmail.com
push date2015-03-19 02:20 +0000
treeherdermozilla-beta@d76c709556bb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjimm, lmandel
bugs1141081
milestone37.0
Bug 1141081 - Ensure nsPluginInstanceOwner::Destroy is called before returning from failed plugin instantiation. r=jimm, a=lmandel
dom/plugins/base/nsPluginHost.cpp
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -813,34 +813,38 @@ nsPluginHost::InstantiatePluginInstance(
   nsresult rv = instanceOwner->Init(ourContent);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   nsPluginTagType tagType;
   rv = instanceOwner->GetTagType(&tagType);
   if (NS_FAILED(rv)) {
+    instanceOwner->Destroy();
     return rv;
   }
 
   if (tagType != nsPluginTagType_Embed &&
       tagType != nsPluginTagType_Applet &&
       tagType != nsPluginTagType_Object) {
+    instanceOwner->Destroy();
     return NS_ERROR_FAILURE;
   }
 
   rv = SetUpPluginInstance(aMimeType, aURL, instanceOwner);
   if (NS_FAILED(rv)) {
+    instanceOwner->Destroy();
     return NS_ERROR_FAILURE;
   }
   const bool isAsyncInit = (rv == NS_PLUGIN_INIT_PENDING);
 
   nsRefPtr<nsNPAPIPluginInstance> instance;
   rv = instanceOwner->GetInstance(getter_AddRefs(instance));
   if (NS_FAILED(rv)) {
+    instanceOwner->Destroy();
     return rv;
   }
 
   // Async init plugins will initiate their own widget creation.
   if (!isAsyncInit && instance) {
     CreateWidget(instanceOwner);
   }