From 762b4a768286a1b0902370e981529930bde71b6b Mon Sep 17 00:00:00 2001 From: "bzbarsky%mit.edu" Date: Wed, 7 Dec 2005 00:52:39 +0000 Subject: [PATCH] Fix crash bug 316012, r=biesi, sr=jst git-svn-id: svn://10.0.0.236/trunk@185745 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/layout/generic/nsObjectFrame.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/mozilla/layout/generic/nsObjectFrame.cpp b/mozilla/layout/generic/nsObjectFrame.cpp index 3d052496ebc..956434b0363 100644 --- a/mozilla/layout/generic/nsObjectFrame.cpp +++ b/mozilla/layout/generic/nsObjectFrame.cpp @@ -2796,6 +2796,10 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays() nsINodeInfo *ni = content->NodeInfo(); + // Making DOM method calls can cause our frame to go away, which + // might kill us... + nsCOMPtr kungFuDeathGrip(this); + if (ni->NamespaceEquals(kNameSpaceID_XHTML)) { // For XHTML elements we need to take the namespace URI into // account when looking for param elements. @@ -2862,6 +2866,9 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays() } } + // We're done with DOM method calls now; make sure we still have a frame. + NS_ENSURE_TRUE(mOwner, NS_ERROR_OUT_OF_MEMORY); + PRUint32 cparams; ourParams->Count(&cparams); // unsigned 32 bits to unsigned 16 bits conversion if (cparams < 0x0000FFFF)