664682 - Invalid NPIdentifiers returned from NPN_GetStringIdentifier during NPObject enumeration (OOPP)

Status: RESOLVED DUPLICATE of bug 653083

(Core Graveyard :: Plug-ins, defect)

Description

[duncantebbs]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17
Build Identifier: Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20110429 Firefox/4.0.1

At first glance, this appears to be a duplicate of this bug:

  https://bugzilla.mozilla.org/show_bug.cgi?id=582012

but on further investigation I don't think it can be.

Occasionally, when multiple instances of the plugin are on the same page, the NPIdentifier for a given string changes, and the new value cannot be used to refer to properties on an NPObject that has previously claimed to have that property.

The code below should illustrate:


    NPIdentifier *npIDs;
    uint32_t npIDCount;

    if (NPN_Enumerate(npp, mNPObject, &npIDs, &npIDCount))
    {
#if defined(DETECT_FIREFOX_BUG)
        char **debugPropNames = (char **)NPN_MemAlloc(npIDCount * sizeof(char *));

        for (uint32_t idIdx = 0 ; idIdx < npIDCount ; ++idIdx)
        {
            TZ_ASSERT(NPN_HasProperty(npp, mNPObject, npIDs[idIdx]));

            debugPropNames[idIdx] = NPN_UTF8FromIdentifier(npIDs[idIdx]);
            TZ_ASSERT(NPN_HasProperty(npp, mNPObject, npIDs[idIdx]));

            NPIdentifier debugNPID =
                NPN_GetStringIdentifier(debugPropNames[idIdx]);

            // !! THIS FAILS !!
            TZ_ASSERT(NPN_HasProperty(npp, mNPObject, debugNPID));  // <<<<
        }

        NPN_MemFree(debugPropNames);
#endif // DETECT_FIREFOX_BUG

        // Our code ....

        // Free the NPIdentifier list

        NPN_MemFree(npIDs);
    }

For each identifier returned from NPN_Enumerate, this debug code saves the utf8 string, and uses that string to re-lookup the NPIdentifier.  We then query the NPObject for the same property, it occasionally fails using the new NPIdentifier.

This only happens when the plugins are running out-of-process.


Reproducible: Always

Comment 1

[duncantebbs]

I should have mentioned that we happen to already know that the identifiers are strings, but I've added code to the snippet to be 100% sure.

The assert still fires with this code:

    NPIdentifier *npIDs;
    uint32_t npIDCount;

    if (NPN_Enumerate(npp, mNPObject, &npIDs, &npIDCount))
    {
#if defined(DETECT_FIREFOX_BUG)
        for (uint32_t idIdx = 0 ; idIdx < npIDCount ; ++idIdx)
        {
            TZ_ASSERT(NPN_HasProperty(npp, mNPObject, npIDs[idIdx]));

            if (NPN_IdentifierIsString(npIDs[idIdx]))
            {
                char *debugPropName = NPN_UTF8FromIdentifier(npIDs[idIdx]);
                TZ_ASSERT(NPN_HasProperty(npp, mNPObject, npIDs[idIdx]));

                NPIdentifier debugNPID =
                    NPN_GetStringIdentifier(debugPropName);

                // !! FAILS !!
                TZ_ASSERT(NPN_HasProperty(npp, mNPObject, debugNPID));

                NPN_MemFree(debugPropName);
            }
        }
#endif // DETECT_FIREFOX_BUG

        // Do our thing ....

        // Free the NPIdentifier list

        NPN_MemFree(npIDs);
    }