620243 - PluginModuleChild::DeallocNPObject should handle d before freeing aNPObj

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Plug-ins, defect)

Description

[timeless]

1955 PluginModuleChild::DeallocNPObject(NPObject* aNPObj)
1956 {
1957     if (aNPObj->_class && aNPObj->_class->deallocate) {
1958         aNPObj->_class->deallocate(aNPObj);
1959     } else {
this is a free:
1960         child::_memfree(aNPObj);
1961     }

and this is a potential use which scares coverity:
1963     NPObjectData* d = current()->mObjectMap.GetEntry(aNPObj);
1964     if (d->actor)
1965         d->actor->NPObjectDestroyed();
1966 
1967     current()->mObjectMap.RemoveEntry(aNPObj);
1968 }

Comment 1

[timeless]

Attachment: proposal

Comment 2

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 498668 [details] [diff] [review]
proposal

I don't think this is relevant any more.

Comment 3

[Georg Fritzsche [:gfritzsche]]

Does this still show up in Coverity runs?
I still have to get approved by an admin on the Coverity site for the Fx scan.

Comment 4

[Siim Ainsaar]

The problem in this bug has been refactored into bug 1195272, still existent and looking risky.

Comment 6

[Benjamin Smedberg]

Resolving old bugs which are likely not relevant any more, since NPAPI plugins are deprecated.