From acc78670c366eff209a4f04a50293ca26fe32d6e Mon Sep 17 00:00:00 2001
From: "jst%mozilla.org" <jst%mozilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sat, 18 Apr 2009 17:54:41 +0000
Subject: [PATCH] Fixing bug 486269. Prevent plugins from being destroyed while
 calling into them. r=joshmoz@gmail.com, sr=bzbarsky@mit.edu,
 a=dveditz@cruzio.com

git-svn-id: svn://10.0.0.236/trunk@256969 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../modules/plugin/base/src/nsJSNPRuntime.cpp | 49 ++++++++++++-------
 1 file changed, 30 insertions(+), 19 deletions(-)

diff --git a/mozilla/modules/plugin/base/src/nsJSNPRuntime.cpp b/mozilla/modules/plugin/base/src/nsJSNPRuntime.cpp
index 1d130c5e232..27167f6e2cb 100644
--- a/mozilla/modules/plugin/base/src/nsJSNPRuntime.cpp
+++ b/mozilla/modules/plugin/base/src/nsJSNPRuntime.cpp
@@ -1148,6 +1148,8 @@ NPObjWrapper_AddProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     return JS_FALSE;
   }
 
+  PluginDestructionGuard pdg(LookupNPP(npobj));
+
   // We must permit methods here since JS_DefineUCFunction() will add
   // the function as a property
   if (!npobj->_class->hasProperty(npobj, (NPIdentifier)id) &&
@@ -1172,6 +1174,8 @@ NPObjWrapper_DelProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     return JS_FALSE;
   }
 
+  PluginDestructionGuard pdg(LookupNPP(npobj));
+
   if (!npobj->_class->hasProperty(npobj, (NPIdentifier)id)) {
     ThrowJSException(cx, "Trying to remove unsupported property on scriptable "
                      "plugin object!");
@@ -1194,13 +1198,6 @@ NPObjWrapper_SetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     return JS_FALSE;
   }
 
-  if (!npobj->_class->hasProperty(npobj, (NPIdentifier)id)) {
-    ThrowJSException(cx, "Trying to set unsupported property on scriptable "
-                     "plugin object!");
-
-    return JS_FALSE;
-  }
-
   // Find out what plugin (NPP) is the owner of the object we're
   // manipulating, and make it own any JSObject wrappers created here.
   NPP npp = LookupNPP(npobj);
@@ -1211,6 +1208,15 @@ NPObjWrapper_SetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     return JS_FALSE;
   }
 
+  PluginDestructionGuard pdg(npp);
+
+  if (!npobj->_class->hasProperty(npobj, (NPIdentifier)id)) {
+    ThrowJSException(cx, "Trying to set unsupported property on scriptable "
+                     "plugin object!");
+
+    return JS_FALSE;
+  }
+
   NPVariant npv;
   if (!JSValToNPVariant(npp, cx, *vp, &npv)) {
     ThrowJSException(cx, "Error converting jsval to NPVariant!");
@@ -1245,20 +1251,19 @@ NPObjWrapper_GetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     return JS_FALSE;
   }
 
+  // Find out what plugin (NPP) is the owner of the object we're
+  // manipulating, and make it own any JSObject wrappers created here.
+  NPP npp = LookupNPP(npobj);
+  if (!npp) {
+    ThrowJSException(cx, "No NPP found for NPObject!");
+
+    return JS_FALSE;
+  }
+
+  PluginDestructionGuard pdg(npp);
+
   PRBool hasProperty = npobj->_class->hasProperty(npobj, (NPIdentifier)id);
   PRBool hasMethod = npobj->_class->hasMethod(npobj, (NPIdentifier)id);
-  NPP npp = nsnull;
-  if (hasProperty) {
-    // Find out what plugin (NPP) is the owner of the object we're
-    // manipulating, and make it own any JSObject wrappers created
-    // here.
-    npp = LookupNPP(npobj);
-    if (!npp) {
-      ThrowJSException(cx, "No NPP found for NPObject!");
-
-      return JS_FALSE;
-    }
-  }
 
   // To support ambiguous members, we return NPObject Member class here.
   if (hasProperty && hasMethod)
@@ -1318,6 +1323,8 @@ CallNPMethodInternal(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
     return JS_FALSE;
   }
 
+  PluginDestructionGuard pdg(npp);
+
   NPVariant npargs_buf[8];
   NPVariant *npargs = npargs_buf;
 
@@ -1445,6 +1452,8 @@ NPObjWrapper_newEnumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
     return JS_FALSE;
   }
 
+  PluginDestructionGuard pdg(LookupNPP(npobj));
+
   NS_ASSERTION(statep, "Must have a statep to enumerate!");
 
   switch(enum_op) {
@@ -1515,6 +1524,8 @@ NPObjWrapper_NewResolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
     return JS_FALSE;
   }
 
+  PluginDestructionGuard pdg(LookupNPP(npobj));
+
   if (npobj->_class->hasProperty(npobj, (NPIdentifier)id)) {
     JSBool ok;