Fix a crash related to PPAPI scripting.

webkit/plugins/ppapi/message_channel.cc

-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/message_channel.h"
 
 #include <cstdlib>
 #include <string>
 
 #include "base/bind.h"
 #include "base/logging.h"
@@ skipping 27 matching lines @@
 namespace webkit {
 
 namespace ppapi {
 
 namespace {
 
 const char kPostMessage[] = "postMessage";
 
 // Helper function to get the MessageChannel that is associated with an
 // NPObject*.
-MessageChannel& ToMessageChannel(NPObject* object) {
-  return *(static_cast<MessageChannel::MessageChannelNPObject*>(object)->
-      message_channel);
+MessageChannel* ToMessageChannel(NPObject* object) {
+  return static_cast<MessageChannel::MessageChannelNPObject*>(object)->
+      message_channel;
+}
+
+NPObject* ToPassThroughObject(NPObject* object) {
+  MessageChannel* channel = ToMessageChannel(object);
+  return channel ? channel->passthrough_object() : NULL;
 }
 
 // Helper function to determine if a given identifier is equal to kPostMessage.
 bool IdentifierIsPostMessage(NPIdentifier identifier) {
   return WebBindings::getStringIdentifier(kPostMessage) == identifier;
 }
 
 // Converts the given PP_Var to a v8::Value, returning true on success.
 // False means that the given variant is invalid. In this case, |result| will
 // be set to an empty handle.
@@ skipping 104 matching lines @@
 
 bool MessageChannelHasMethod(NPObject* np_obj, NPIdentifier name) {
   if (!np_obj)
     return false;
 
   // We only handle a function called postMessage.
   if (IdentifierIsPostMessage(name))
     return true;
 
   // Other method names we will pass to the passthrough object, if we have one.
-  NPObject* passthrough = ToMessageChannel(np_obj).passthrough_object();
+  NPObject* passthrough = ToPassThroughObject(np_obj);
   if (passthrough)
     return WebBindings::hasMethod(NULL, passthrough, name);
   return false;
 }
 
 bool MessageChannelInvoke(NPObject* np_obj, NPIdentifier name,
                           const NPVariant* args, uint32 arg_count,
                           NPVariant* result) {
   if (!np_obj)
     return false;
 
   // We only handle a function called postMessage.
   if (IdentifierIsPostMessage(name) && (arg_count == 1)) {
-    MessageChannel& message_channel(ToMessageChannel(np_obj));
-    PP_Var argument(NPVariantToPPVar(message_channel.instance(), &args[0]));
-    message_channel.PostMessageToNative(argument);
-    PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(argument);
-    return true;
+    MessageChannel* message_channel = ToMessageChannel(np_obj);
+    if (message_channel) {
+      PP_Var argument(NPVariantToPPVar(message_channel->instance(), &args[0]));
+      message_channel->PostMessageToNative(argument);
+      PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(argument);
+      return true;
+    } else {
+      return false;
+    }
   }
   // Other method calls we will pass to the passthrough object, if we have one.
-  NPObject* passthrough = ToMessageChannel(np_obj).passthrough_object();
+  NPObject* passthrough = ToPassThroughObject(np_obj);
   if (passthrough) {
     return WebBindings::invoke(NULL, passthrough, name, args, arg_count,
                                result);
   }
   return false;
 }
 
 bool MessageChannelInvokeDefault(NPObject* np_obj,
                                  const NPVariant* args,
                                  uint32 arg_count,
                                  NPVariant* result) {
   if (!np_obj)
     return false;
 
   // Invoke on the passthrough object, if we have one.
-  NPObject* passthrough = ToMessageChannel(np_obj).passthrough_object();
+  NPObject* passthrough = ToPassThroughObject(np_obj);
   if (passthrough) {
     return WebBindings::invokeDefault(NULL, passthrough, args, arg_count,
                                       result);
   }
   return false;
 }
 
 bool MessageChannelHasProperty(NPObject* np_obj, NPIdentifier name) {
   if (!np_obj)
     return false;
 
   // Invoke on the passthrough object, if we have one.
-  NPObject* passthrough = ToMessageChannel(np_obj).passthrough_object();
+  NPObject* passthrough = ToPassThroughObject(np_obj);
   if (passthrough)
     return WebBindings::hasProperty(NULL, passthrough, name);
   return false;
 }
 
 bool MessageChannelGetProperty(NPObject* np_obj, NPIdentifier name,
                                NPVariant* result) {
   if (!np_obj)
     return false;
 
   // Don't allow getting the postMessage function.
   if (IdentifierIsPostMessage(name))
     return false;
 
   // Invoke on the passthrough object, if we have one.
-  NPObject* passthrough = ToMessageChannel(np_obj).passthrough_object();
+  NPObject* passthrough = ToPassThroughObject(np_obj);
   if (passthrough)
     return WebBindings::getProperty(NULL, passthrough, name, result);
   return false;
 }
 
 bool MessageChannelSetProperty(NPObject* np_obj, NPIdentifier name,
                                const NPVariant* variant) {
   if (!np_obj)
     return false;
 
   // Don't allow setting the postMessage function.
   if (IdentifierIsPostMessage(name))
     return false;
 
   // Invoke on the passthrough object, if we have one.
-  NPObject* passthrough = ToMessageChannel(np_obj).passthrough_object();
+  NPObject* passthrough = ToPassThroughObject(np_obj);
   if (passthrough)
     return WebBindings::setProperty(NULL, passthrough, name, variant);
   return false;
 }
 
 bool MessageChannelEnumerate(NPObject *np_obj, NPIdentifier **value,
                              uint32_t *count) {
   if (!np_obj)
     return false;
 
   // Invoke on the passthrough object, if we have one, to enumerate its
   // properties.
-  NPObject* passthrough = ToMessageChannel(np_obj).passthrough_object();
+  NPObject* passthrough = ToPassThroughObject(np_obj);
   if (passthrough) {
     bool success = WebBindings::enumerate(NULL, passthrough, value, count);
     if (success) {
       // Add postMessage to the list and return it.
       if (std::numeric_limits<size_t>::max() / sizeof(NPIdentifier) <=
           (*count + 1))
         return false;
       NPIdentifier* new_array = static_cast<NPIdentifier*>(
           std::malloc(sizeof(NPIdentifier) * (*count + 1)));
       std::memcpy(new_array, *value, sizeof(NPIdentifier)*(*count));
@@ skipping 23 matching lines @@
   &MessageChannelHasProperty,
   &MessageChannelGetProperty,
   &MessageChannelSetProperty,
   NULL,
   &MessageChannelEnumerate,
 };
 
 }  // namespace
 
 // MessageChannel --------------------------------------------------------------
-MessageChannel::MessageChannelNPObject::MessageChannelNPObject()
-    : message_channel(NULL) {
+MessageChannel::MessageChannelNPObject::MessageChannelNPObject() {
 }
 
 MessageChannel::MessageChannelNPObject::~MessageChannelNPObject() {}
 
 MessageChannel::MessageChannel(PluginInstance* instance)
     : instance_(instance),
       passthrough_object_(NULL),
       np_object_(NULL),
       ALLOW_THIS_IN_INITIALIZER_LIST(weak_ptr_factory_(this)) {
   // Now create an NPObject for receiving calls to postMessage. This sets the
   // reference count to 1.  We release it in the destructor.
   NPObject* obj = WebBindings::createObject(NULL, &message_channel_class);
   DCHECK(obj);
   np_object_ = static_cast<MessageChannel::MessageChannelNPObject*>(obj);
-  np_object_->message_channel = this;
+  np_object_->message_channel = weak_ptr_factory_.GetWeakPtr();
 }
 
 void MessageChannel::PostMessageToJavaScript(PP_Var message_data) {
   // Serialize the message data.
   v8::HandleScope scope;
   // Because V8 is probably not on the stack for Native->JS calls, we need to
   // enter the appropriate context for the plugin.
   v8::Local<v8::Context> context =
       instance_->container()->element().document().frame()->
           mainWorldScriptContext();
@@ skipping 77 matching lines @@
   // invokes:
   //   SetPassthroughObject(passthrough_object());
   if (passthrough_object_)
     WebBindings::releaseObject(passthrough_object_);
 
   passthrough_object_ = passthrough;
 }
 
 }  // namespace ppapi
 }  // namespace webkit