Bug 41431 - REGRESSION (r49411): Various crashes due to JavaScript execution during plug-in destruction
Summary: REGRESSION (r49411): Various crashes due to JavaScript execution during plug-...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Plug-ins (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.6
: P2 Normal
Assignee: Alexey Proskuryakov
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2010-06-30 15:12 PDT by Alexey Proskuryakov
Modified: 2018-01-19 16:30 PST (History)
3 users (show)

See Also:


Attachments
proposed fix (14.50 KB, patch)
2010-06-30 16:14 PDT, Alexey Proskuryakov
darin: review+
Details | Formatted Diff | Diff
an alternative WebKit part of the fix (4.14 KB, patch)
2010-07-01 10:29 PDT, Alexey Proskuryakov
andersca: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2010-06-30 15:12:41 PDT
We didn't use to support executing arbitrary JavaScript code during plug-in destruction in out of process case. This got accidentally enabled in r49411.

Long term, we should do the same thing in in process and out of process cases, and the same as other browsers - which likely means allowing JS execution from NPP_Destroy (although there are lots of bugs and limitations there). But there is an unfortunate twist for out of process plug-ins, which makes WebKit take this code path even if plug-in didn't intend that:
1) Plug-in executes NPN_Evaluate, a sync message is sent to the browser.
2) At the same time, the browser stops the plug-in, and sends synchronous NPP_Destroy to plug-in.
3) The browser enters a loop, handling messages that come from plug-in, and waiting for a response to NPP_Destroy.
4) So, it executes the script from step 1 that could have been dropped.
Comment 1 Alexey Proskuryakov 2010-06-30 15:13:01 PDT
<rdar://problem/8148656>
Comment 2 Alexey Proskuryakov 2010-06-30 16:14:01 PDT
Created attachment 60164 [details]
proposed fix
Comment 3 Alexey Proskuryakov 2010-06-30 16:43:27 PDT
-    waitForReply<NetscapePluginInstanceProxy::BooleanReply>(requestID);
+    waitForReplyDroppingOtherMessages<NetscapePluginInstanceProxy::BooleanReply>(requestID);

Oops, this doesn't belong here.
Comment 4 Alexey Proskuryakov 2010-07-01 10:29:26 PDT
Created attachment 60261 [details]
an alternative WebKit part of the fix

WebCore and LayoutTests parts are unchanged, not putting them up for review again.
Comment 5 Anders Carlsson 2010-07-01 10:43:49 PDT
Comment on attachment 60261 [details]
an alternative WebKit part of the fix

r=me
Comment 6 Alexey Proskuryakov 2010-07-01 11:48:57 PDT
Committed with alternative WebKit fix in <http://trac.webkit.org/changeset/62279>.