Comment #9 on issue 25439 by [email protected]: Crash -
PluginChannel::CleanUp()
http://code.google.com/p/chromium/issues/detail?id=25439
The following revision refers to this bug:
http://src.chromium.org/viewvc/chrome?view=rev&revision=29982
------------------------------------------------------------------------
r29982 | [email protected] | 2009-10-23 17:50:27 -0700 (Fri, 23 Oct 2009) |
6 lines
Changed paths:
A
http://src.chromium.org/viewvc/chrome/trunk/src/chrome/test/data/npapi/npobject_released_on_destruction.html
M
http://src.chromium.org/viewvc/chrome/trunk/src/chrome/test/ui/npapi_uitest.cc?r1=29982&r2=29981
M
http://src.chromium.org/viewvc/chrome/trunk/src/webkit/tools/npapi_layout_test_plugin/TestObject.cpp?r1=29982&r2=29981
M
http://src.chromium.org/viewvc/chrome/trunk/src/webkit/tools/npapi_layout_test_plugin/TestObject.h?r1=29982&r2=29981
Add a regression test for the PluginChannel::CleanUp. My earlier
speculative fix was correct.
I tracked this down to my earlier change to not leak NPObjects on channel
shutdown (which now happens a lot more often because of sudden termination
for tab close). Since we now call an NPObject's deallocate function, it's
possible that it leads to an NPObjectProxy being deleted, in which case we
would delete an object in the listener's array while we're looping across
it.
BUG=25439
Review URL: http://codereview.chromium.org/332013
------------------------------------------------------------------------
--
You received this message because you are listed in the owner
or CC fields of this issue, or because you starred this issue.
You may adjust your issue notification preferences at:
http://code.google.com/hosting/settings
--~--~---------~--~----~------------~-------~--~----~
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/group/chromium-bugs
-~----------~----~----~----~------~----~------~--~---
