superreview requested: [Bug 309044] Flashplayer 8 "Bad NPObject as private data!" : [Attachment 201809] Take a plugin's scriptable object out of the plugin element's prototype chain on plugin destruc

Johnny Stenback <jst@mozilla.org> has asked Brendan Eich <brendan@mozilla.org>
for superreview:
Bug 309044: Flashplayer 8 "Bad NPObject as private data!"
https://bugzilla.mozilla.org/show_bug.cgi?id=309044

Attachment 201809: Take a plugin's scriptable object out of the plugin
element's prototype chain on plugin destruction
https://bugzilla.mozilla.org/attachment.cgi?id=201809&action=edit

------- Additional Comments from Johnny Stenback <jst@mozilla.org>
What's happening here is that flash block touches the flash plugin element on
page load only to remove it, when it does that we end up getting the plugin's
scriptable object and sticking it on the plugin element's prototype chain. Once
the plugin element is removed the plugin instance is destroyed and the plugin's
scriptable object is invalidated (its private data is set to null), then the
flash block code (or the testcase code, not sure, and it doesn't matter either)
tries to use the plugin element, and when it does that we end up resolving
properties on the plugin element's JS object, which ends up going down the
prototype chain to the dead plugin's scriptable object. And there we throw the
error.

I don't see any problems here with object's being GC'd or anything like that,
it all looks fine to me in the debugger, and this all makes sense.

The fix makes the plugin scriptability code take the plugin scriptability
object out of the plugin element's prototype chain when the plugin is
destroyed.
0
bugzilla
11/4/2005 12:42:22 AM
netscape.mozilla.reviewers 29156 articles. 0 followers. Follow

0 Replies
636 Views

Similar Articles

[PageSpeed] 3

Reply:

Similar Artilces:

superreview granted: [Bug 309044] Flashplayer 8 "Bad NPObject as private data!" : [Attachment 201809] Take a plugin's scriptable object out of the plugin element's prototype chain on plugin destructi
Brendan Eich <brendan@mozilla.org> has granted Johnny Stenback <jst@mozilla.org>'s request for superreview: Bug 309044: Flashplayer 8 "Bad NPObject as private data!" https://bugzilla.mozilla.org/show_bug.cgi?id=309044 Attachment 201809: Take a plugin's scriptable object out of the plugin element's prototype chain on plugin destruction https://bugzilla.mozilla.org/attachment.cgi?id=201809&action=edit ------- Additional Comments from Brendan Eich <brendan@mozilla.org> sr=me. /be ...

superreview requested: [Bug 303521] !!! Object's nsIClassInfo lies about it's interfaces!!! s.b. "its" : [Attachment 191706] fix spelling
timeless@myrealbox.com (working) <timeless@bemail.org> has asked Johnny Stenback <jst@mozilla.org> for superreview: Bug 303521: !!! Object's nsIClassInfo lies about it's interfaces!!! s.b. "its" https://bugzilla.mozilla.org/show_bug.cgi?id=303521 Attachment 191706: fix spelling https://bugzilla.mozilla.org/attachment.cgi?id=191706&action=edit ...

superreview requested: [Bug 309044] Flashplayer 8 "Bad NPObject as private data!" : [Attachment 203609] This should fix it
Boris Zbarsky <bzbarsky@mit.edu> has asked Johnny Stenback <jst@mozilla.org> for superreview: Bug 309044: Flashplayer 8 "Bad NPObject as private data!" https://bugzilla.mozilla.org/show_bug.cgi?id=309044 Attachment 203609: This should fix it https://bugzilla.mozilla.org/attachment.cgi?id=203609&action=edit ------- Additional Comments from Boris Zbarsky <bzbarsky@mit.edu> Makes sure to look in the right scope... That doesn't matter for WrapNative, but does for GetWrappedNativeOfNativeObj, unfortunately. ...

superreview requested: [Bug 408749] "ASSERTION: A block's child' s next in flow's parent must be a block" with -moz-column, table stuff : [ Attachment 293607] fix assert
Robert O'Callahan (:roc) <roc@ocallahan.org> has asked Boris Zbarsky (reviews very slow until spring) <bzbarsky@mit.edu> for superreview: Bug 408749: "ASSERTION: A block's child's next in flow's parent must be a block" with -moz-column, table stuff https://bugzilla.mozilla.org/show_bug.cgi?id=408749 Attachment 293607: fix assert https://bugzilla.mozilla.org/attachment.cgi?id=293607&action=edit ------- Additional Comments from Robert O'Callahan (:roc) <roc@ocallahan.org> This patch creates nsBlockFrame* nsLayoutUtils::GetAsBlock wh...

superreview requested: [Bug 408749] "ASSERTION: A block's child' s next in flow's parent must be a block" with -moz-column, table stuff : [ Attachment 293637] reflow captions with unconstrained height
Robert O'Callahan (:roc) <roc@ocallahan.org> has asked Boris Zbarsky (reviews very slow until spring) <bzbarsky@mit.edu> for superreview: Bug 408749: "ASSERTION: A block's child's next in flow's parent must be a block" with -moz-column, table stuff https://bugzilla.mozilla.org/show_bug.cgi?id=408749 Attachment 293637: reflow captions with unconstrained height https://bugzilla.mozilla.org/attachment.cgi?id=293637&action=edit ------- Additional Comments from Robert O'Callahan (:roc) <roc@ocallahan.org> Fixes the assertion independen...

superreview granted: [Bug 303521] !!! Object's nsIClassInfo lies about it's interfaces!!! s.b. "its" : [Attachment 191706] fix spelling
Johnny Stenback <jst@mozilla.org> has granted timeless@myrealbox.com (working) <timeless@bemail.org>'s request for superreview: Bug 303521: !!! Object's nsIClassInfo lies about it's interfaces!!! s.b. "its" https://bugzilla.mozilla.org/show_bug.cgi?id=303521 Attachment 191706: fix spelling https://bugzilla.mozilla.org/attachment.cgi?id=191706&action=edit ------- Additional Comments from Johnny Stenback <jst@mozilla.org> r+sr=jst either way... ...

superreview requested: [Bug 304239] Fix issues in NSPR's real_install makefile target : [Attachment 192310] Report NSPR 4.6's version as "4.6" instead of "4.6.0"
Wan-Teh Chang <wtchang@redhat.com> has asked Chris Seawood <cls@seawood.org> for superreview: Bug 304239: Fix issues in NSPR's real_install makefile target https://bugzilla.mozilla.org/show_bug.cgi?id=304239 Attachment 192310: Report NSPR 4.6's version as "4.6" instead of "4.6.0" https://bugzilla.mozilla.org/attachment.cgi?id=192310&action=edit ------- Additional Comments from Wan-Teh Chang <wtchang@redhat.com> Will dropping the 0 patch level break any script (e.g., mozilla's --with-system-nspr configure option)? ...

superreview requested: [Bug 378544] General's Default Feed Viewer's " =?UTF-8?Q?Select=E2=80=A6?=" doesn't use real elipsis
Stuart Morgan <stuart.morgan@alumni.case.edu> has asked Mike Pinkerton <mikepinkerton@mac.com> for superreview: Bug 378544: General's Default Feed Viewer's "Select=E2=80=A6" doesn't use r= eal elipsis https://bugzilla.mozilla.org/show_bug.cgi?id=3D378544 Attachment 264750: changed https://bugzilla.mozilla.org/attachment.cgi?id=3D264750&action=3Dedit= ...

superreview denied: [Bug 198515] When print a plugin, browser give the wrong file pointer to plugin. : [Attachment 127915] New patch per bz's and roc+moz's IRC comments
Boris Zbarsky <bzbarsky@mit.edu> has denied Roland Mainz (not reading bugmail) <Roland.Mainz@informatik.med.uni-giessen.de>'s request for superreview: Bug 198515: When print a plugin, browser give the wrong file pointer to plugin. http://bugzilla.mozilla.org/show_bug.cgi?id=198515 Attachment 127915: New patch per bz's and roc+moz's IRC comments http://bugzilla.mozilla.org/attachment.cgi?id=127915&action=edit ------- Additional Comments from Boris Zbarsky <bzbarsky@mit.edu> >Index: gfx/public/nsIRenderingContext.h First thing is that you want...

superreview requested: [Bug 198515] When print a plugin, browser give the wrong file pointer to plugin. : [Attachment 127560] New patch per peterl's review comments
Roland Mainz (not reading bugmail) <Roland.Mainz@informatik.med.uni-giessen.de> has asked Boris Zbarsky <bzbarsky@mit.edu> for superreview: Bug 198515: When print a plugin, browser give the wrong file pointer to plugin. http://bugzilla.mozilla.org/show_bug.cgi?id=198515 Attachment 127560: New patch per peterl's review comments http://bugzilla.mozilla.org/attachment.cgi?id=127560&action=edit ...

superreview requested: [Bug 403173] Change "it's" to "it is" in Empty Cache dialog : [Attachment 294624] No more " =?UTF-8?Q?it=E2=80=99s?=" in the cache
Smokey Ardisson (no bugmail - do not email) <alqahira@ardisson.org> has ask= ed Mark Mentovai <mark@moxienet.com> for superreview: Bug 403173: Change "it's" to "it is" in Empty Cache dialog https://bugzilla.mozilla.org/show_bug.cgi?id=3D403173 Attachment 294624: No more "it=E2=80=99s" in the cache https://bugzilla.mozilla.org/attachment.cgi?id=3D294624&action=3Dedit ------- Additional Comments from Smokey Ardisson (no bugmail - do not email) <alqahira@ardisson.org> (In reply to comment #3)=0D > This should probably be ano...

superreview granted: [Bug 408749] "ASSERTION: A block's child' s next in flow's parent must be a block" with -moz-column, table stuff : [ Attachment 293607] fix assert
Boris Zbarsky (reviews very slow until spring) <bzbarsky@mit.edu> has granted Robert O'Callahan (:roc) <roc@ocallahan.org>'s request for superreview: Bug 408749: "ASSERTION: A block's child's next in flow's parent must be a block" with -moz-column, table stuff https://bugzilla.mozilla.org/show_bug.cgi?id=408749 Attachment 293607: fix assert https://bugzilla.mozilla.org/attachment.cgi?id=293607&action=edit ------- Additional Comments from Boris Zbarsky (reviews very slow until spring) <bzbarsky@mit.edu> Looks good. That said, s...

superreview granted: [Bug 309044] Flashplayer 8 "Bad NPObject as private data!" : [Attachment 203609] This should fix it
Johnny Stenback <jst@mozilla.org> has granted Boris Zbarsky <bzbarsky@mit.edu>'s request for superreview: Bug 309044: Flashplayer 8 "Bad NPObject as private data!" https://bugzilla.mozilla.org/show_bug.cgi?id=309044 Attachment 203609: This should fix it https://bugzilla.mozilla.org/attachment.cgi?id=203609&action=edit ------- Additional Comments from Johnny Stenback <jst@mozilla.org> r+sr=jst ...

superreview granted: [Bug 408749] "ASSERTION: A block's child' s next in flow's parent must be a block" with -moz-column, table stuff : [ Attachment 293637] reflow captions with unconstrained height
Boris Zbarsky (reviews very slow until spring) <bzbarsky@mit.edu> has granted Robert O'Callahan (:roc) <roc@ocallahan.org>'s request for superreview: Bug 408749: "ASSERTION: A block's child's next in flow's parent must be a block" with -moz-column, table stuff https://bugzilla.mozilla.org/show_bug.cgi?id=408749 Attachment 293637: reflow captions with unconstrained height https://bugzilla.mozilla.org/attachment.cgi?id=293637&action=edit ...

Web resources about - superreview requested: [Bug 309044] Flashplayer 8 "Bad NPObject as private data!" : [Attachment 201809] Take a plugin's scriptable object out of the plugin element's prototype chain on plugin destruc - netscape.mozilla.reviewers

Resources last updated: 12/25/2015 12:10:55 PM