PPAPI: Really force-free NPObjects on Instance destruction.

webkit/plugins/ppapi/host_var_tracker.cc

Index: webkit/plugins/ppapi/host_var_tracker.cc
diff --git a/webkit/plugins/ppapi/host_var_tracker.cc b/webkit/plugins/ppapi/host_var_tracker.cc
index 51ba0e84453b02f6d7c53971008f863ab37c8ced..293b6d9395cec614c20012a7563467ad23aa56a5 100644
--- a/webkit/plugins/ppapi/host_var_tracker.cc
+++ b/webkit/plugins/ppapi/host_var_tracker.cc
@@ -98,15 +98,12 @@ void HostVarTracker::ForceFreeNPObjectsForInstance(PP_Instance instance) {
     return;  // Nothing to do.
   NPObjectToNPObjectVarMap* np_object_map = found_instance->second.get();
 
-  // Force delete all var references. Need to make a copy so we can iterate over
-  // the map while deleting stuff from it.
-  NPObjectToNPObjectVarMap np_object_map_copy = *np_object_map;

[dmichael (off chromium), 2012/02/17 22:45:10]

I realized this copy really *is* necessary (now). Consider an in-process,
trusted plugin. When we force-release an object, its PPP_Class_Deallocate
function might force-release another object and thus delete it from our map
while we're iterating.

I fixed this case, added a test, and improved the existing comment.

-  NPObjectToNPObjectVarMap::iterator cur_var =
-      np_object_map_copy.begin();
-  while (cur_var != np_object_map_copy.end()) {
+  NPObjectToNPObjectVarMap::iterator cur_var = np_object_map->begin();
+  while (cur_var != np_object_map->end()) {
     NPObjectToNPObjectVarMap::iterator current = cur_var++;
     current->second->InstanceDeleted();
-    np_object_map->erase(current->first);
+    ForceReleaseNPObject(current->second);
+    np_object_map->erase(current);
   }
 
   // Remove the record for this instance since it should be empty.
@@ -114,5 +111,16 @@ void HostVarTracker::ForceFreeNPObjectsForInstance(PP_Instance instance) {
   instance_map_.erase(found_instance);
 }
 
+void HostVarTracker::ForceReleaseNPObject(::ppapi::NPObjectVar* object) {
+  VarMap::iterator iter = live_vars_.find(object->GetExistingVarID());
+  if (iter == live_vars_.end()) {
+    NOTREACHED();
+    return;
+  }
+  iter->second.ref_count = 0;
+  DCHECK(iter->second.track_with_no_reference_count == 0);
+  DeleteObjectInfoIfNecessary(iter);
+}
+
 }  // namespace ppapi
 }  // namespace webkit