[PATCH] Fix invalid RPC after NPP_Destroy()

[Gwenole Beauchesne]

Hi,

Le 4 déc. 08 à 07:23, Gwenole Beauchesne a écrit :

> I got a crash in npviewer.bin for windowed plugins too through other  
> tests and it could be an NObject refcounting problem. What happens  
> is the NPObject returned for NPPVpluginScriptableNPObject is still  
> accessed beyond NPP_Destroy() through the NPClass::Invalidate()  
> member function. That NPObject refcount is 1 after its  
> NPN_ReleaseObject() in NPP_Destroy() whereas I think it should have  
> been 0. One fix to this problem would require the same strategy  
> Martin used to "shutdown" the npruntime bridge, but at a finer  
> granularity. i.e. keep track of NPObjects and their associated NPP  
> instance. If their parent instance dies, mark the NPObjects as  
> invalid (and release them actually -- memory leaks).

The attached patch (from SVN) should fix this problem.

Actually, it seems Flash's NPPVpluginScriptableNPObject needs to  
reference the NPP instance, and the plugin window too. So,  
PluginInstance bound to an NPObject are reference counted and plugin  
window destruction delayed to PluginInstance::finalize(). In practise,  
with Flash10, this occurs around NP_Shutdown().

Regards,
Gwenole

-------------- next part --------------
A non-text attachment was scrubbed...
Name: nspluginwrapper-fix-NPClass::Invalidate.patch
Type: application/octet-stream
Size: 3787 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/nspluginwrapper-devel-list/attachments/20081208/e3814a99/attachment.obj>
-------------- next part --------------