Bug 5306 – KHTMLPart::requestObject doesn't destroy old plugin content

• Component: Layout and Rendering
• Status: VERIFIED FIXED

Summary: Changes to an OBJECT node's children can trigger a new request for the object content. When 
this happens, the old child frame with the old plugin view doesn't get destroyed and in fact keeps 
running.

To reproduce:
1) You need the Flash plugin
2) Open Activity Monitor or use 'top' to measure Safari's CPU usage
3) Open the testcase
4) Click the "Click to test" link and wait until "Running..." changes back to the link
5) Repeat step 4 two or three times if Safari's CPU usage does not appear to change

Expected: Safari's CPU usage to not change

Actual: Safari's CPU usage increases to close to 100% of what's available

Analysis: A change to the OBJECT node's children triggers updateWidget on the RenderPartObject, which 
calls KHTMLPart::requestObject, which does not discard the old child frame (and associated plugin view) 
but instead just adds a new one. The increase in CPU usage is a result of multiple instances of the 
plugin running simultaneously. As far as I can see, only one of them is discarded when the Safari 
window is closed, so I also suspect a memory leak.

Created attachment 4266 [details]
testcase (uses external resource)

Created attachment 4291 [details]
detach() to destroy old plugin

[Maciej Stachowiak]

Looks good to me. Is there any chance of makng a test case that works without a remote resource and can 
work as a layout test? I'm guessing no, so I guess it's ok to add the current one as a manual test.

[Vicki Murley]

I'll commit this.