1045178 - NPObject leak in PluginScriptableObjectChild::ResurrectProxyObject

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[(No longer employed by Mozilla) Aaron Klotz]

We create a new NPObject in PluginScriptableObjectChild::ResurrectProxyObject() but don't do anything with it. Then we call InitializeProxy() which creates a second NPObject that is actually registered as the NPObject of record to be used with the actor.

Since the same actor is associated with both NPObjects, this can cause double frees of the actor when the NPObjects are destroyed.

Comment 1

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: Fix NPObject leak

Comment 2

[John Schoenick [:johns]]

Comment on attachment 8463628 [details] [diff] [review]
Fix NPObject leak

Review of attachment 8463628 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM

::: dom/plugins/ipc/PluginScriptableObjectChild.cpp
@@ +454,3 @@
>  
>    if (!PluginModuleChild::current()->RegisterActorForNPObject(object, this)) {
>      NS_ERROR("Out of memory?");

This message doesn't make any sense...

Comment 3

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: Fix NPObject leak

Fixed error message from review comment. Carrying forward r+.

Comment 4

[(No longer employed by Mozilla) Aaron Klotz]

https://tbpl.mozilla.org/?tree=Try&rev=3aa8bbf6d9a0

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6b73e003d67a

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/6b73e003d67a