Fix race condition with windowless plugin buffers. The problem, which is already fixed for Mac, is that the buffers can be deleted during a paint because of a resize during an NPN_Evaluate call. So keep a local reference.

BUG=139462
Review URL: https://chromiumcodereview.appspot.com/10855141

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@151734 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 37 insertions, 4 deletions

diff --git a/webkit/plugins/npapi/test/plugin_test.h b/webkit/plugins/npapi/test/plugin_test.h
index f600946..ee8752c 100644
--- a/webkit/plugins/npapi/test/plugin_test.h
+++ b/webkit/plugins/npapi/test/plugin_test.h
@@ -64,7 +64,6 @@ class PluginTest {
   // appropriate error about it.
   void ExpectIntegerEqual(int val1, int val2);
 
- protected:
   // Signals to the Test that invoked us that the test is
   // completed.  This is done by forcing the plugin to
   // set a cookie in the browser window, which the test program
@@ -75,6 +74,7 @@ class PluginTest {
   // received the SetWindow() callback from the browser.
   void SignalTestCompleted();
 
+ protected:
   // Helper function to lookup names in the input array.
   // If the name is found, returns the value, otherwise
   // returns NULL.
diff --git a/webkit/plugins/npapi/test/plugin_test_factory.cc b/webkit/plugins/npapi/test/plugin_test_factory.cc
index 754da6d..f412f3c 100644
--- a/webkit/plugins/npapi/test/plugin_test_factory.cc
+++ b/webkit/plugins/npapi/test/plugin_test_factory.cc
@@ -43,7 +43,8 @@ PluginTest* CreatePluginTest(const std::string& test_name,
     new_test = new NPObjectIdentityTest(instance, host_functions);
   } else if (test_name == "npobject_proxy") {
     new_test = new NPObjectProxyTest(instance, host_functions);
-  } else if (test_name == "invoke_js_function_on_create"
+  } else if (test_name == "invoke_js_function_on_create" ||
+             test_name == "resize_during_paint"
 #if defined(OS_WIN) || defined(OS_MACOSX)
           // TODO(port): plugin_windowless_test.*.
           || test_name == "execute_script_delete_in_paint" ||
diff --git a/webkit/plugins/npapi/test/plugin_windowless_test.cc b/webkit/plugins/npapi/test/plugin_windowless_test.cc
index 57aa81f..09a254e 100644
--- a/webkit/plugins/npapi/test/plugin_windowless_test.cc
+++ b/webkit/plugins/npapi/test/plugin_windowless_test.cc
@@ -11,6 +11,8 @@
 #if defined(OS_MACOSX)
 #include <ApplicationServices/ApplicationServices.h>
 #include <Carbon/Carbon.h>
+#elif defined(TOOLKIT_GTK)
+#include <gdk/gdkx.h>
 #endif
 
 namespace NPAPIClient {
@@ -18,9 +20,14 @@ namespace NPAPIClient {
 // Remember the first plugin instance for tests involving multiple instances
 WindowlessPluginTest* g_other_instance = NULL;
 
+void OnFinishTest(void* data) {
+  static_cast<WindowlessPluginTest*>(data)->SignalTestCompleted();
+}
+
 WindowlessPluginTest::WindowlessPluginTest(NPP id,
                                            NPNetscapeFuncs *host_functions)
-    : PluginTest(id, host_functions) {
+    : PluginTest(id, host_functions),
+      paint_counter_(0) {
   if (!g_other_instance)
     g_other_instance = this;
 }
@@ -30,6 +37,8 @@ static bool IsPaintEvent(NPEvent* np_event) {
   return WM_PAINT == np_event->event;
 #elif defined(OS_MACOSX)
   return np_event->what == updateEvt;
+#elif defined(TOOLKIT_GTK)
+  return np_event->type == GraphicsExpose;
 #else
   NOTIMPLEMENTED();
   return false;
@@ -72,7 +81,6 @@ NPError WindowlessPluginTest::New(uint16 mode, int16 argc,
 }
 
 int16 WindowlessPluginTest::HandleEvent(void* event) {
-
   NPNetscapeFuncs* browser = NPAPIClient::PluginClient::HostFunctions();
 
   NPBool supports_windowless = 0;
@@ -86,6 +94,7 @@ int16 WindowlessPluginTest::HandleEvent(void* event) {
 
   NPEvent* np_event = reinterpret_cast<NPEvent*>(event);
   if (IsPaintEvent(np_event)) {
+    paint_counter_++;
 #if defined(OS_WIN)
     HDC paint_dc = reinterpret_cast<HDC>(np_event->wParam);
     if (paint_dc == NULL) {
@@ -109,6 +118,21 @@ int16 WindowlessPluginTest::HandleEvent(void* event) {
       ExecuteScriptDeleteInPaint(browser);
     } else if (test_name() == "multiple_instances_sync_calls") {
       MultipleInstanceSyncCalls(browser);
+    } else if (test_name() == "resize_during_paint") {
+      if (paint_counter_ == 1) {
+        // So that we get another paint later.
+        browser->invalidaterect(id(), NULL);
+      } else if (paint_counter_ == 2) {
+        // Do this in the second paint since that's asynchronous. The first
+        // paint will always be synchronous (since the renderer process doesn't
+        // have a cache of the plugin yet). If we try calling NPN_Evaluate while
+        // WebKit is painting, it will assert since style recalc is happening
+        // during painting.
+        ExecuteScriptResizeInPaint(browser);
+
+        // So that we can exit the test after the message loop is unrolled.
+        browser->pluginthreadasynccall(id(), OnFinishTest, this);
+      }
     }
 #if defined(OS_MACOSX)
   } else if (IsWindowActivationEvent(np_event) &&
@@ -159,6 +183,11 @@ void WindowlessPluginTest::ExecuteScriptDeleteInPaint(
   SignalTestCompleted();
 }
 
+void WindowlessPluginTest::ExecuteScriptResizeInPaint(
+    NPNetscapeFuncs* browser) {
+  ExecuteScript(browser, id(), "ResizePluginWithinScript();", NULL);
+}
+
 void WindowlessPluginTest::MultipleInstanceSyncCalls(NPNetscapeFuncs* browser) {
   if (this == g_other_instance)
     return;
diff --git a/webkit/plugins/npapi/test/plugin_windowless_test.h b/webkit/plugins/npapi/test/plugin_windowless_test.h
index 88f19e4..1669ebf 100644
--- a/webkit/plugins/npapi/test/plugin_windowless_test.h
+++ b/webkit/plugins/npapi/test/plugin_windowless_test.h
@@ -28,8 +28,11 @@ class WindowlessPluginTest : public PluginTest {
   NPError ExecuteScript(NPNetscapeFuncs* browser, NPP id,
       const std::string& script, NPVariant* result);
   void ExecuteScriptDeleteInPaint(NPNetscapeFuncs* browser);
+  void ExecuteScriptResizeInPaint(NPNetscapeFuncs* browser);
   void MultipleInstanceSyncCalls(NPNetscapeFuncs* browser);
   void ConvertPoint(NPNetscapeFuncs* browser);
+
+  int paint_counter_;
 };
 
 }  // namespace NPAPIClient