diff options
3 files changed, 30 insertions, 2 deletions
diff --git a/webkit/api/src/WebPluginContainerImpl.cpp b/webkit/api/src/WebPluginContainerImpl.cpp index fb1e416..6e2dc42 100644 --- a/webkit/api/src/WebPluginContainerImpl.cpp +++ b/webkit/api/src/WebPluginContainerImpl.cpp @@ -255,8 +255,10 @@ void WebPluginContainerImpl::loadFrameRequest( // FIXME: This is a bit of hack to allow us to observe completion of // our frame request. It would be better to evolve FrameLoader to // support a completion callback instead. - WebDataSourceImpl::setNextPluginLoadObserver( - new WebPluginLoadObserver(this, request.url(), notifyData)); + WebPluginLoadObserver* observer = + new WebPluginLoadObserver(this, request.url(), notifyData); + m_pluginLoadObservers.append(observer); + WebDataSourceImpl::setNextPluginLoadObserver(observer); } FrameLoadRequest frameRequest(request.toResourceRequest()); @@ -312,6 +314,8 @@ void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver WebPluginContainerImpl::~WebPluginContainerImpl() { + for (size_t i = 0; i < m_pluginLoadObservers.size(); ++i) + m_pluginLoadObservers[i]->clearPluginContainer(); m_webPlugin->destroy(); } diff --git a/webkit/data/layout_tests/chrome/plugins/get-url-with-iframe-target-no-crash-expected.txt b/webkit/data/layout_tests/chrome/plugins/get-url-with-iframe-target-no-crash-expected.txt new file mode 100644 index 0000000..64edcc7 --- /dev/null +++ b/webkit/data/layout_tests/chrome/plugins/get-url-with-iframe-target-no-crash-expected.txt @@ -0,0 +1,3 @@ +This tests that we do not crash upon trying to deliver NPP_URLNotify to a plugin that has been deleted. +SUCCESS + diff --git a/webkit/data/layout_tests/chrome/plugins/get-url-with-iframe-target-no-crash.html b/webkit/data/layout_tests/chrome/plugins/get-url-with-iframe-target-no-crash.html new file mode 100644 index 0000000..35d1a09 --- /dev/null +++ b/webkit/data/layout_tests/chrome/plugins/get-url-with-iframe-target-no-crash.html @@ -0,0 +1,21 @@ +<html> +<script> +function runtest() { + if (window.layoutTestController) { + layoutTestController.dumpAsText(); + layoutTestController.waitUntilDone(); + plg.getURLNotify("data:text/html,<body onload='layoutTestController.notifyDone()'></body>", "frame", "callback"); + plg.parentNode.removeChild(plg) + } else { + document.write("Cannot run interactively"); + } +} +</script> +<body onload="runtest()"> +<embed id="plg" type="application/x-webkit-test-netscape"></embed> +This tests that we do not crash upon trying to deliver NPP_URLNotify to +a plugin that has been deleted. +<div id="result">SUCCESS</div> +<iframe id="frame"></iframe> +</body> +</html> |