Oilpan: always limit persisted plugin disposal to PluginViews instances.

third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 76 matching lines @@
 {
     visitor->trace(m_imageLoader);
     visitor->trace(m_persistedPluginWidget);
     HTMLFrameOwnerElement::trace(visitor);
 }
 
 #if ENABLE(OILPAN)
 void HTMLPlugInElement::disconnectContentFrame()
 {
     if (m_persistedPluginWidget) {
-        m_persistedPluginWidget->dispose();
+        if (m_persistedPluginWidget->isPluginView())
+            m_persistedPluginWidget->dispose();

[dcheng, 2015/12/11 07:47:09]

Is the only other possible case here that m_persistedPluginWidget->isFrameView()
is true?

In that case, it's safe to skip it here because it gets cleared as part of
detaching the actual frame, right>

[sof, 2015/12/11 08:01:18]

Yes, I think it is safe to do the disposal unconditionally for this code path. I
added the check to be consistent about only calling dispose() for PluginViews
over persisted widgets.

[dcheng, 2015/12/11 08:11:22]

Let's add an else { ASSERT(m_persistedPluginWidget->isFrameView()) } then.

         m_persistedPluginWidget = nullptr;
     }
     HTMLFrameOwnerElement::disconnectContentFrame();
 }
 
 void HTMLPlugInElement::shouldDisposePlugin()
 {
     if (m_persistedPluginWidget && m_persistedPluginWidget->isPluginView())
         toPluginView(m_persistedPluginWidget.get())->shouldDisposePlugin();
 }
 #endif
 
 void HTMLPlugInElement::setPersistedPluginWidget(Widget* widget)
 {
     if (m_persistedPluginWidget == widget)
         return;
 #if ENABLE(OILPAN)
     unregisterAsRenderlessIfNeeded();
     registerAsRenderless(widget);
-    if (m_persistedPluginWidget) {
+    if (m_persistedPluginWidget && m_persistedPluginWidget->isPluginView()) {

[dcheng, 2015/12/11 08:11:22]

Ditto, let's split this so we can have an explicit ASSERT.

         m_persistedPluginWidget->hide();
         m_persistedPluginWidget->dispose();
     }
 #endif
     m_persistedPluginWidget = widget;
 }
 
 #if ENABLE(OILPAN)
 bool HTMLPlugInElement::unregisterAsRenderlessIfNeeded()
 {
@@ skipping 535 matching lines @@
     return openShadowRoot();
 }
 
 void HTMLPlugInElement::lazyReattachIfNeeded()
 {
     if (!useFallbackContent() && needsWidgetUpdate() && layoutObject() && !isImageType())
         lazyReattachIfAttached();
 }
 
 }