When the plugin crashes, cleanup references to its window in the renderer.

This avoids spurious messages when the plugin crashes, and potential issues (plugin crashes, the HWND/XID gets destroyed, a new one gets created by a new instance and gets the same HWND/XID, the browser operates on the new one instead of the old one).

Review URL: http://codereview.chromium.org/160614


git-svn-id: svn://svn.chromium.org/chrome/trunk/src@22688 0039d316-1c4b-4281-b951-d872f2087c98

7 files changed, 33 insertions, 2 deletions

diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 9b5806c..6b3d127f 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -3246,6 +3246,10 @@ void RenderView::DidMovePlugin(const WebPluginGeometry& move) {
   SchedulePluginMove(move);
 }
 
+void RenderView::WillDestroyPluginWindow(gfx::PluginWindowHandle window) {
+  CleanupWindowInPluginMoves(window);
+}
+
 void RenderView::SendPasswordForms(WebFrame* frame) {
   std::vector<WebForm> forms;
   frame->GetForms(&forms);
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index e676272..cc2eb98 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -315,6 +315,7 @@ class RenderView : public RenderWidget,
   virtual bool WasOpenedByUserGesture() const;
   virtual void FocusAccessibilityObject(WebCore::AccessibilityObject* acc_obj);
   virtual void DidMovePlugin(const WebPluginGeometry& move);
+  virtual void WillDestroyPluginWindow(gfx::PluginWindowHandle handle);
   virtual void SpellCheck(const std::wstring& word, int* misspell_location,
                           int* misspell_length);
   virtual std::wstring GetAutoCorrectWord(const std::wstring& word);
diff --git a/chrome/renderer/render_widget.cc b/chrome/renderer/render_widget.cc
index e6ac408..6f2d5fc 100644
--- a/chrome/renderer/render_widget.cc
+++ b/chrome/renderer/render_widget.cc
@@ -845,3 +845,13 @@ void RenderWidget::SchedulePluginMove(const WebPluginGeometry& move) {
   if (i == plugin_window_moves_.size())
     plugin_window_moves_.push_back(move);
 }
+
+void RenderWidget::CleanupWindowInPluginMoves(gfx::PluginWindowHandle window) {
+  for (WebPluginGeometryVector::iterator i = plugin_window_moves_.begin();
+       i != plugin_window_moves_.end(); ++i) {
+    if (i->window == window) {
+      plugin_window_moves_.erase(i);
+      break;
+    }
+  }
+}
diff --git a/chrome/renderer/render_widget.h b/chrome/renderer/render_widget.h
index 7c6e592..ea7ef5e 100644
--- a/chrome/renderer/render_widget.h
+++ b/chrome/renderer/render_widget.h
@@ -86,6 +86,10 @@ class RenderWidget : public IPC::Channel::Listener,
   // the next paint or scroll message to the host.
   void SchedulePluginMove(const WebPluginGeometry& move);
 
+  // Called when a plugin window has been destroyed, to make sure the currently
+  // pending moves don't try to reference it.
+  void CleanupWindowInPluginMoves(gfx::PluginWindowHandle window);
+
   // Invalidates entire widget rect to generate a full repaint.
   void GenerateFullRepaint();
 
@@ -283,7 +287,8 @@ class RenderWidget : public IPC::Channel::Listener,
   bool activatable_;
 
   // Holds all the needed plugin window moves for a scroll.
-  std::vector<WebPluginGeometry> plugin_window_moves_;
+  typedef std::vector<WebPluginGeometry> WebPluginGeometryVector;
+  WebPluginGeometryVector plugin_window_moves_;
 
   // A custom background for the widget.
   SkBitmap background_;
diff --git a/chrome/renderer/webplugin_delegate_proxy.cc b/chrome/renderer/webplugin_delegate_proxy.cc
index 53d50be..283c405 100644
--- a/chrome/renderer/webplugin_delegate_proxy.cc
+++ b/chrome/renderer/webplugin_delegate_proxy.cc
@@ -172,6 +172,7 @@ WebPluginDelegateProxy::WebPluginDelegateProxy(const std::string& mime_type,
     : render_view_(render_view),
       plugin_(NULL),
       windowless_(false),
+      window_(NULL),
       mime_type_(mime_type),
       clsid_(clsid),
       npobject_(NULL),
@@ -386,8 +387,14 @@ void WebPluginDelegateProxy::OnMessageReceived(const IPC::Message& msg) {
 }
 
 void WebPluginDelegateProxy::OnChannelError() {
-  if (plugin_)
+  if (plugin_) {
+    if (window_) {
+      // The actual WebPluginDelegate never got a chance to tell the WebPlugin
+      // its window was going away. Do it on its behalf.
+      plugin_->WillDestroyWindow(window_);
+    }
     plugin_->Invalidate();
+  }
   render_view_->PluginCrashed(GetProcessId(), plugin_path_);
 }
 
@@ -691,6 +698,7 @@ int WebPluginDelegateProxy::GetProcessId() {
 
 void WebPluginDelegateProxy::OnSetWindow(gfx::PluginWindowHandle window) {
   windowless_ = !window;
+  window_ = window;
   if (plugin_)
     plugin_->SetWindow(window);
 }
diff --git a/chrome/renderer/webplugin_delegate_proxy.h b/chrome/renderer/webplugin_delegate_proxy.h
index aefac28..7d70dd3 100644
--- a/chrome/renderer/webplugin_delegate_proxy.h
+++ b/chrome/renderer/webplugin_delegate_proxy.h
@@ -166,6 +166,7 @@ class WebPluginDelegateProxy : public WebPluginDelegate,
   RenderView* render_view_;
   WebPlugin* plugin_;
   bool windowless_;
+  gfx::PluginWindowHandle window_;
   scoped_refptr<PluginChannelHost> channel_host_;
   std::string mime_type_;
   std::string clsid_;
diff --git a/webkit/glue/webplugin_impl.cc b/webkit/glue/webplugin_impl.cc
index d7fee6d..0fe8fc2 100644
--- a/webkit/glue/webplugin_impl.cc
+++ b/webkit/glue/webplugin_impl.cc
@@ -413,6 +413,8 @@ void WebPluginImpl::SetWindow(gfx::PluginWindowHandle window) {
 }
 
 void WebPluginImpl::WillDestroyWindow(gfx::PluginWindowHandle window) {
+  DCHECK_EQ(window, window_);
+  window_ = NULL;
   WebCore::Frame* frame = element_->document()->frame();
   WebFrameImpl* webframe = WebFrameImpl::FromFrame(frame);
   WebViewImpl* webview = webframe->GetWebViewImpl();