WebCore:

2009-03-03  Anders Carlsson  <andersca@apple.com>

        Reviewed by John Sullivan.

        https://bugs.webkit.org/show_bug.cgi?id=22884
        <rdar://problem/6449783>
        modified layout test crashes Safari

        Null check NPStream before dereferencing it.

        * plugins/PluginView.cpp:
        (WebCore::PluginView::destroyStream):

WebKitTools:

2009-03-03  Anders Carlsson  <andersca@apple.com>

        Reviewed by John Sullivan.

        https://bugs.webkit.org/show_bug.cgi?id=22884
        <rdar://problem/6449783>
        modified layout test crashes Safari

        Add destroyNullStream test function to the test plug-in.

        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp:
        (destroyNullStream):
        (pluginInvoke):

LayoutTests:

2009-03-03  Anders Carlsson  <andersca@apple.com>

        Reviewed by John Sullivan.

        https://bugs.webkit.org/show_bug.cgi?id=22884
        <rdar://problem/6449783>
        modified layout test crashes Safari

        Update tests.
        * plugins/destroy-stream-twice-expected.txt:
        * plugins/destroy-stream-twice.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@41414 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 6b9c41597939af666eeadccf1cb0923d6d70f70c..1c24e16c348d28619bdb0797e2b78d0e678d2104 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2009-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22884
+        <rdar://problem/6449783>
+        modified layout test crashes Safari
+        
+        Update tests.
+        * plugins/destroy-stream-twice-expected.txt:
+        * plugins/destroy-stream-twice.html:
+
 2009-03-03  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Simon Fraser.

diff --git a/LayoutTests/plugins/destroy-stream-twice-expected.txt b/LayoutTests/plugins/destroy-stream-twice-expected.txt
index e19a5ac65efbfb113b88dee8ff83cb3f6de055f2..f401d35e4269aaf270d925c69f130037ef7f91bc 100644 (file)
--- a/LayoutTests/plugins/destroy-stream-twice-expected.txt
+++ b/LayoutTests/plugins/destroy-stream-twice-expected.txt
@@ -7,6 +7,7 @@ destroyStream() returns zero to indicate success, or a non-zero error code to in
 PASS document.getElementById('plugin').hasStream is true
 PASS document.getElementById('plugin').destroyStream() is 2
 PASS document.getElementById('plugin').destroyStream() is 2
+PASS document.getElementById('plugin').destroyNullStream() is 2
 PASS: You didn't crash.
 
 PASS successfullyParsed is true

diff --git a/LayoutTests/plugins/destroy-stream-twice.html b/LayoutTests/plugins/destroy-stream-twice.html
index 8d0a6a640f4fefc1b1ff9a44fe89c2643ffa5211..ad37d08edfee4dd209d8766ef3cfe357743d46a4 100644 (file)
--- a/LayoutTests/plugins/destroy-stream-twice.html
+++ b/LayoutTests/plugins/destroy-stream-twice.html
@@ -25,6 +25,8 @@ function runTest()
     shouldBe("document.getElementById('plugin').destroyStream()", "2"); // we expect to fail because the stream should already have completed loading and destroyed itself
     shouldBe("document.getElementById('plugin').destroyStream()", "2"); // try again, just for good measure
 
+    shouldBe("document.getElementById('plugin').destroyNullStream()", "2"); // Now try destroying a null stream
+
     debug("PASS: You didn't crash.\n");
 
     shouldBeTrue("successfullyParsed");

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index ec3fe4667025bf74ecf5b1db92ffccfe5bf6d6be..f0a1729010af76b242f0e48156518c3aaa59dc87 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2009-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22884
+        <rdar://problem/6449783>
+        modified layout test crashes Safari
+
+        Null check NPStream before dereferencing it.
+        
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::destroyStream):
+
 2009-03-03  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Simon Fraser.

diff --git a/WebCore/plugins/PluginView.cpp b/WebCore/plugins/PluginView.cpp
index 86b2f0ff1ee92c1b95249ad3032f27a34ef84eb1..715225aeb68231d6e48c366471803227cf048482 100644 (file)
--- a/WebCore/plugins/PluginView.cpp
+++ b/WebCore/plugins/PluginView.cpp
@@ -397,12 +397,12 @@ int32 PluginView::write(NPStream* stream, int32 len, void* buffer)
 
 NPError PluginView::destroyStream(NPStream* stream, NPReason reason)
 {
-    PluginStream* browserStream = static_cast<PluginStream*>(stream->ndata);
-
     if (!stream || PluginStream::ownerForStream(stream) != m_instance)
         return NPERR_INVALID_INSTANCE_ERROR;
 
+    PluginStream* browserStream = static_cast<PluginStream*>(stream->ndata);
     browserStream->cancelAndDestroyStream(reason);
+
     return NPERR_NO_ERROR;
 }
 

diff --git a/WebKitTools/ChangeLog b/WebKitTools/ChangeLog
index 2de22c24771902a181b6f87eba5bf5c5b9c547cc..a565e982252a79e682a32f631142f2c62e68eb50 100644 (file)
--- a/WebKitTools/ChangeLog
+++ b/WebKitTools/ChangeLog
@@ -1,3 +1,17 @@
+2009-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22884
+        <rdar://problem/6449783>
+        modified layout test crashes Safari
+
+        Add destroyNullStream test function to the test plug-in.
+        
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp:
+        (destroyNullStream):
+        (pluginInvoke):
+
 2009-03-03  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Darin Adler

diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp
index 91809839d1dd57d4df16edce3ab7ff16efae2aef..60b26a65386f17354966ba793d9805ddfc800dc7 100644 (file)
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp
@@ -99,7 +99,8 @@ static const NPUTF8 *pluginPropertyIdentifierNames[NUM_PROPERTY_IDENTIFIERS] = {
 #define ID_TEST_POSTURL_FILE        14
 #define ID_TEST_CONSTRUCT           15
 #define ID_TEST_THROW_EXCEPTION_METHOD 16
-#define NUM_METHOD_IDENTIFIERS      17
+#define ID_DESTROY_NULL_STREAM 17
+#define NUM_METHOD_IDENTIFIERS      18
 
 static NPIdentifier pluginMethodIdentifiers[NUM_METHOD_IDENTIFIERS];
 static const NPUTF8 *pluginMethodIdentifierNames[NUM_METHOD_IDENTIFIERS] = {
@@ -120,6 +121,7 @@ static const NPUTF8 *pluginMethodIdentifierNames[NUM_METHOD_IDENTIFIERS] = {
     "testPostURLFile",
     "testConstruct",
     "testThrowException",
+    "destroyNullStream"
 };
 
 static NPUTF8* createCStringFromNPVariant(const NPVariant* variant)
@@ -382,6 +384,13 @@ static bool destroyStream(PluginObject* obj, const NPVariant* args, uint32_t arg
     return true;
 }
 
+static bool destroyNullStream(PluginObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result)
+{
+    NPError npError = browser->destroystream(obj->npp, 0, NPRES_USER_BREAK);
+    INT32_TO_NPVARIANT(npError, *result);
+    return true;
+}
+
 static bool testEnumerate(PluginObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result)
 {
     if (argCount != 2 || !NPVARIANT_IS_OBJECT(args[0]) || !NPVARIANT_IS_OBJECT(args[1]))
@@ -578,7 +587,8 @@ static bool pluginInvoke(NPObject* header, NPIdentifier name, const NPVariant* a
     else if (name == pluginMethodIdentifiers[ID_TEST_THROW_EXCEPTION_METHOD]) {
         browser->setexception(header, "plugin object testThrowException SUCCESS");
         return true;
-    }
+    } else if (name == pluginMethodIdentifiers[ID_DESTROY_NULL_STREAM]) 
+        return destroyNullStream(plugin, args, argCount, result);
     
     return false;
 }