Support reviving a disposed plugin container.

third_party/WebKit/Source/web/WebPluginContainerImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 249 matching lines @@
 
     Widget::setParent(widget);
     if (widget)
         reportGeometry();
     else if (m_webPlugin)
         m_webPlugin->containerDidDetachFromParent();
 }
 
 void WebPluginContainerImpl::setPlugin(WebPlugin* plugin)
 {
-    RELEASE_ASSERT(!m_inDispose);
-    if (plugin != m_webPlugin) {
-        m_element->resetInstance();
-        m_webPlugin = plugin;
-    }
+    if (plugin == m_webPlugin)
+        return;
+
+    m_element->resetInstance();
+    m_webPlugin = plugin;
+    m_isDisposed = false;
 }
 
 float WebPluginContainerImpl::deviceScaleFactor()
 {
     Page* page = m_element->document().page();
     if (!page)
         return 1.0;
     return page->deviceScaleFactor();
 }
 
@@ skipping 216 matching lines @@
     FrameLoadRequest frameRequest(frame->document(), request.toResourceRequest(), target);
     frame->loader().load(frameRequest);
 }
 
 bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
 {
     // Disallow access to the frame during dispose(), because it is not guaranteed to
     // be valid memory once this object has started disposal. In particular, we might be being
     // disposed because the frame has already be deleted and then something else dropped the
     // last reference to the this object.
-    if (m_inDispose || !m_element)
+    if (m_isDisposed || !m_element)
         return false;
 
     LocalFrame* frame = m_element->document().frame();
     if (!frame)
         return false;
 
     IntRect documentRect(x() + rect.x, y() + rect.y, rect.width, rect.height);
     // hitTestResultAtPoint() takes a padding rectangle.
     // FIXME: We'll be off by 1 when the width or height is even.
     LayoutPoint center = documentRect.center();
     // Make the rect we're checking (the point surrounded by padding rects) contained inside the requested rect. (Note that -1/2 is 0.)
     LayoutSize padding((documentRect.width() - 1) / 2, (documentRect.height() - 1) / 2);
     HitTestResult result = frame->eventHandler().hitTestResultAtPoint(center, HitTestRequest::ReadOnly | HitTestRequest::Active | HitTestRequest::ListBased, padding);
     const HitTestResult::NodeSet& nodes = result.listBasedTestResult();
     if (nodes.size() != 1)
         return false;
     return nodes.first().get() == m_element;
 }
 
 void WebPluginContainerImpl::requestTouchEventType(TouchEventRequestType requestType)
 {
-    if (m_touchEventRequestType == requestType)
+    if (m_touchEventRequestType == requestType || !m_element)
         return;
 
     if (m_element->document().frameHost()) {
         EventHandlerRegistry& registry = m_element->document().frameHost()->eventHandlerRegistry();
         if (requestType != TouchEventRequestTypeNone && m_touchEventRequestType == TouchEventRequestTypeNone)
             registry.didAddEventHandler(*m_element, EventHandlerRegistry::TouchEvent);
         else if (requestType == TouchEventRequestTypeNone && m_touchEventRequestType != TouchEventRequestTypeNone)
             registry.didRemoveEventHandler(*m_element, EventHandlerRegistry::TouchEvent);
     }
     m_touchEventRequestType = requestType;
@@ skipping 132 matching lines @@
 
 // Private methods -------------------------------------------------------------
 
 WebPluginContainerImpl::WebPluginContainerImpl(HTMLPlugInElement* element, WebPlugin* webPlugin)
     : LocalFrameLifecycleObserver(element->document().frame())
     , m_element(element)
     , m_webPlugin(webPlugin)
     , m_webLayer(nullptr)
     , m_touchEventRequestType(TouchEventRequestTypeNone)
     , m_wantsWheelEvents(false)
-    , m_inDispose(false)
+    , m_isDisposed(false)
 {
 #if ENABLE(OILPAN)
     ThreadState::current()->registerPreFinalizer(this);
 #endif
 }
 
 WebPluginContainerImpl::~WebPluginContainerImpl()
 {
 #if ENABLE(OILPAN)
     // The plugin container must have been disposed of by now.
     ASSERT(!m_webPlugin);
 #else
     dispose();
 #endif
 }
 
 void WebPluginContainerImpl::dispose()
 {
-    m_inDispose = true;
+    m_isDisposed = true;
 
-    if (m_element && m_touchEventRequestType != TouchEventRequestTypeNone && m_element->document().frameHost())
-        m_element->document().frameHost()->eventHandlerRegistry().didRemoveEventHandler(*m_element, EventHandlerRegistry::TouchEvent);
+    requestTouchEventType(TouchEventRequestTypeNone);
 
     if (m_webPlugin) {
         RELEASE_ASSERT(!m_webPlugin->container() || m_webPlugin->container() == this);
         m_webPlugin->destroy();
         m_webPlugin = nullptr;
     }
 
     if (m_webLayer) {
         GraphicsLayer::unregisterContentsLayer(m_webLayer);
         m_webLayer = nullptr;
     }
-
-    m_element = nullptr;
 }
 
 DEFINE_TRACE(WebPluginContainerImpl)
 {
     visitor->trace(m_element);
     LocalFrameLifecycleObserver::trace(visitor);
     PluginView::trace(visitor);
 }
 
 void WebPluginContainerImpl::handleMouseEvent(MouseEvent* event)
@@ skipping 227 matching lines @@
         // frame view.
         computeClipRectsForPlugin(m_element, windowRect, clipRect, unobscuredRect);
     }
     getPluginOcclusions(m_element, this->parent(), frameRect(), cutOutRects);
     // Convert to the plugin position.
     for (size_t i = 0; i < cutOutRects.size(); i++)
         cutOutRects[i].move(-frameRect().x(), -frameRect().y());
 }
 
 } // namespace blink