Bug 36563 – A plug-in makes Safari crash on http://www.itscodingtime.com/

• Component: Plug-ins
• Status: RESOLVED FIXED

[Alexey Proskuryakov]

Steps to reproduce: install Silverlight, go to http://www.itscodingtime.com/.

Here is what happens:
1) WebKit calls NetscapePluginInstanceProxy::resize(), and starts waiting for reply.
2) Instead of a reply, it gets an WKPCGetProperty call from plug-in first.
3) The object the plug-in wants to get a property of is actually a plug-in object, so WebKit calls plugin host via ProxyInstance::fieldNamed().
4) Silverlight crashes, taking plug-in host with it.
5) NetscapePluginHostProxy::pluginHostDied() destroys host proxy object, and clears all references to it.
6) WebKit returns to "event loop" in NetscapePluginInstanceProxy::processRequestsAndWaitForReply, waiting for a reply to resize().
7) But m_pluginHostProxy is null already, so it crashes.

[Alexey Proskuryakov]

Created attachment 51566 [details]
proposed fix

[WebKit Review Bot]

Attachment 51566 [details] did not pass style-queue:

Failed to run "WebKitTools/Scripts/check-webkit-style" exit_code: 1
WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.h:46:  More than one command on the same line  [whitespace/newline] [4]
WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.h:47:  More than one command on the same line  [whitespace/newline] [4]
Total errors found: 2 in 4 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Oliver Hunt]

Comment on attachment 51566 [details]
proposed fix


> +unsigned NetscapePluginHostProxy::s_processingRequests;
It's good form to initialise this.


In all honesty all the ++ and --'s make me wish we just had a struct to automatically increment and decrement this count.

[Anders Carlsson]

Comment on attachment 51566 [details]
proposed fix

r=me

[Alexey Proskuryakov]

Committed <http://trac.webkit.org/changeset/56474>.

>> +unsigned NetscapePluginHostProxy::s_processingRequests;
> It's good form to initialise this.

I'm not sure about that - initializing with 0 just adds visual noise.

[Alexey Proskuryakov]

<rdar://problem/7786332>