Commit 6a9b5b10 authored by trchen's avatar trchen Committed by Commit bot

Fix WebViewPlugin::scheduleAnimation crash

The crash was probably due to accessing a dangling pointer to the plugin
container during a small time frame between PepperWebPluginImpl::destroy()
and the destructor being called. (Speculated from source since no reliable
repro is found.)

This CL clears eveything in the destroy() function as if the destructor has
been called, only delaying memory release.

R=tommycli
BUG=483068

Review URL: https://codereview.chromium.org/1137663006

Cr-Commit-Position: refs/heads/master@{#329309}
parent 303920e6
...@@ -699,6 +699,8 @@ void PepperPluginInstanceImpl::Delete() { ...@@ -699,6 +699,8 @@ void PepperPluginInstanceImpl::Delete() {
fullscreen_container_ = NULL; fullscreen_container_ = NULL;
} }
throttler_.reset();
// Force-unbind any Graphics. In the case of Graphics2D, if the plugin // Force-unbind any Graphics. In the case of Graphics2D, if the plugin
// leaks the graphics 2D, it may actually get cleaned up after our // leaks the graphics 2D, it may actually get cleaned up after our
// destruction, so we need its pointers to be up-to-date. // destruction, so we need its pointers to be up-to-date.
......
...@@ -124,6 +124,7 @@ void PepperWebPluginImpl::destroy() { ...@@ -124,6 +124,7 @@ void PepperWebPluginImpl::destroy() {
// Tell |container_| to clear references to this plugin's script objects. // Tell |container_| to clear references to this plugin's script objects.
if (container_) if (container_)
container_->clearScriptObjects(); container_->clearScriptObjects();
container_ = nullptr;
if (instance_.get()) { if (instance_.get()) {
ppapi::PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(instance_object_); ppapi::PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(instance_object_);
...@@ -131,6 +132,7 @@ void PepperWebPluginImpl::destroy() { ...@@ -131,6 +132,7 @@ void PepperWebPluginImpl::destroy() {
instance_->Delete(); instance_->Delete();
instance_ = NULL; instance_ = NULL;
} }
throttler_.reset();
base::MessageLoop::current()->DeleteSoon(FROM_HERE, this); base::MessageLoop::current()->DeleteSoon(FROM_HERE, this);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment