Fix pepper crash when reattaching plugins in style recalc

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 1711 matching lines @@
             assertLayoutTreeUpdated(*shadowRoot);
     }
 }
 #endif
 
 void Document::updateLayoutTree(StyleRecalcChange change)
 {
     ASSERT(isMainThread());
 
     ScriptForbiddenScope forbidScript;
+    // We should forbid script execution for plugins here because update while layout is changing,
+    // HTMLPlugin element can be reattached and plugin can be destroyed. Plugin can execute scripts
+    // on destroy. It produces crash without PluginScriptForbiddenScope: crbug.com/550427.
+    PluginScriptForbiddenScope pluginForbidScript;

[dcheng, 2016/02/12 20:09:12]

Note that the reason this works is because some parts of Blink now assert that
we're not in a script forbidden scope before trying to execute script:
previously, we would just return and do nothing.

PluginScriptForbiddenScope is ultimately used by code that implements WebPlugin
in content (?): if //content detects one of these is on the stack, it just won't
try to execute script at all, bypassing the asserts.

[pfeldman, 2016/02/17 01:20:31]

How would /core contributor know when to use ScriptForbidden vs
PluginScriptForbidden and why?

[esprehn, 2016/02/18 02:17:30]

PluginScriptForbidden is poorly named, it's more like
PluginDOMScriptingDisabler. It allows plugin scripts to still run, but they're
forbidden from calling back into blink to execute script I think.

In the case of this patch it works by breaking some things in flash probably...
but that's also probably fine. Flash is buggy that it's messing with the page
inside creation/destruction.

 
     if (!view() || !isActive())
         return;
 
     if (view()->shouldThrottleRendering())
         return;
 
     if (change != Force && !needsLayoutTreeUpdate()) {
         if (lifecycle().state() < DocumentLifecycle::StyleClean) {
             // needsLayoutTreeUpdate may change to false without any actual layout tree update.
@@ skipping 4209 matching lines @@
 #ifndef NDEBUG
 using namespace blink;
 void showLiveDocumentInstances()
 {
     Document::WeakDocumentSet& set = Document::liveDocumentSet();
     fprintf(stderr, "There are %u documents currently alive:\n", set.size());
     for (Document* document : set)
         fprintf(stderr, "- Document %p URL: %s\n", document, document->url().string().utf8().data());
 }
 #endif