[Webkit-unassigned] [Bug 154891] [GTK] Tracker for GNOME Shell browser plugin crashes

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=154891

Carlos Garcia Campos <cgarcia at igalia.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |cgarcia at igalia.com
             Status|NEW                         |RESOLVED
         Resolution|---                         |INVALID

--- Comment #2 from Carlos Garcia Campos <cgarcia at igalia.com> ---
All the crashes are actually the same problem in the end, but the crash happens at different moments. It's not a bug in WebKit, even though we could protect WebKit from crashing due to buggy plugins in some cases like in bug #137425. The bug in in the plugin that is not retaining the np object when returning it from NPP_GetValue. WebKit assumes the the plugin does the right think and releases that given reference. At some point the object is released and deallocated and both the plugin and WebKit still have references to the object thinking that it's still alive. That's why the crash is sometimes in the plugin when it tries to use the np object, or in WebKit for the very same reason. I don't know why it doesn't happen in other browsers, looking at firefox code they also release the object right after creating the internal wrapper in NPP_GetValue, I guess they keep another reference somewhere else. In WebKit, the mac port has a quirk PluginQuirks::ReturnsNonRetainedScriptableNPObject 

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161028/3ee8f42e/attachment-0001.html>