Refactor AsyncTick to force Chrome through the reentrancy checks formerly in TickPluginObject, which fixes crashes in Chrome on Windows due to reentrant calls to NPP_URLNotify().

Also fix a bug where pending_ticks_ was not decremented in the reentrancy failure path, which would have caused all future AsyncTick() calls to be ignored.

TEST=repeatedly loaded O3D in Chrome on Windows dozens of times and verified no crashes, whereas previously these crashes were frequent on this machine
BUG=none

Review URL: http://codereview.chromium.org/2824050

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@51911 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 27 insertions, 18 deletions

diff --git a/o3d/plugin/cross/o3d_glue.cc b/o3d/plugin/cross/o3d_glue.cc
index 6de01fd..2f8bcbd 100644
--- a/o3d/plugin/cross/o3d_glue.cc
+++ b/o3d/plugin/cross/o3d_glue.cc
@@ -987,24 +987,9 @@ void PluginObject::PlatformSpecificSetCursor() {
 
 #endif  // OS_LINUX
 
-namespace {
-void TickPluginObject(void* data) {
+void PluginObject::TickPluginObject(void* data) {
   PluginObject* plugin_object = static_cast<PluginObject*>(data);
-
-  // Check the plugin has not been destroyed already. Chrome sometimes invokes
-  // async callbacks after destruction.
-  if (!plugin_object->client())
-    return;
-
-  // Don't allow reentrancy through asynchronous ticks. Chrome sometimes does
-  // this. It is also possible for the asyncronous call to be invoked while
-  // a message is being handled. This prevents that.
-  Client::ScopedIncrement reentrance_count(plugin_object->client());
-  if (reentrance_count.get() > 1)
-    return;
-
-  plugin_object->Tick();
-}
+  plugin_object->ExecuteAsyncTick();
 }
 
 void PluginObject::AsyncTick() {
@@ -1029,7 +1014,7 @@ void PluginObject::AsyncTick() {
                        bool,
                        const std::string&,
                        const std::string&) {
-        plugin_object_->Tick();
+        plugin_object_->ExecuteAsyncTick();
       }
 
      private:
@@ -1056,6 +1041,24 @@ void PluginObject::AsyncTick() {
   }
 }
 
+void PluginObject::ExecuteAsyncTick() {
+  // Check the plugin has not been destroyed already. Chrome sometimes invokes
+  // async callbacks after destruction.
+  if (!client())
+    return;
+
+  // Don't allow reentrancy through asynchronous ticks. Chrome sometimes does
+  // this. It is also possible for the asyncronous call to be invoked while
+  // a message is being handled. This prevents that.
+  Client::ScopedIncrement reentrance_count(client());
+  if (reentrance_count.get() > 1) {
+    --pending_ticks_;
+    return;
+  }
+
+  Tick();
+}
+
 void PluginObject::Tick() {
   DCHECK_GT(pending_ticks_, 0);
   --pending_ticks_;
diff --git a/o3d/plugin/cross/o3d_glue.h b/o3d/plugin/cross/o3d_glue.h
index 3e213641..97c88af 100644
--- a/o3d/plugin/cross/o3d_glue.h
+++ b/o3d/plugin/cross/o3d_glue.h
@@ -517,6 +517,12 @@ class PluginObject: public NPObject {
   Bitmap::Ref GetOffscreenBitmap() const;
 
  private:
+  // Called through the browser's NPN_PluginThreadAsyncCall
+  static void TickPluginObject(void* data);
+
+  // Completes the work of an AsyncTick().
+  void ExecuteAsyncTick();
+
   bool fullscreen_region_valid_;
   int fullscreen_region_x_;
   int fullscreen_region_y_;