diff options
| author | wez@chromium.org <wez@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-03-22 06:39:45 +0000 |
|---|---|---|
| committer | wez@chromium.org <wez@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-03-22 06:39:45 +0000 |
| commit | 1f1b673a19237e919c37dbb36af854f5cbbd8908 (patch) | |
| tree | ddf084f892893795e3b4bb5bd03aa1e9e209d9be /base/timer_unittest.cc | |
| parent | 50cf0ca00aab33701ddcf6711a2e997f3d2ee931 (diff) | |
| download | chromium_src-1f1b673a19237e919c37dbb36af854f5cbbd8908.zip chromium_src-1f1b673a19237e919c37dbb36af854f5cbbd8908.tar.gz chromium_src-1f1b673a19237e919c37dbb36af854f5cbbd8908.tar.bz2 | |
Make sure the plugin scriptable object is released before NPP_Destroy.
When the we tear down a plugin instance the plugin process first invokes NPP_Destroy, and then tears down the IPC channel to the renderer, to give NPP_Destroy a chance to do last-minute scripting. When the IPC channel for the last instance is torn down we also clean up the IPC channels and stubs for any plugin-side NPObjects that remain.
We suspect that some plugins implement the scriptable object as part of the plugin instance, rather than independently ref-counted, so that our releasing the object after NPP_Destroy actually triggers the plugin process to crash.
This CL tears down the stub for the plugin's scriptable object before we call NPP_Destroy.
As per crbug.com/119414, we will remove this code if it doesn't significantly impact crashes.
BUG=101968
Review URL: http://codereview.chromium.org/9817023
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@128179 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'base/timer_unittest.cc')
0 files changed, 0 insertions, 0 deletions