| Index: third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
|
| diff --git a/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp b/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
|
| index 2c892986b337f6902db1d7402c977f11f692ba6b..3aee4e566f3e309b68b8eb59449141db46fae47d 100644
|
| --- a/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
|
| +++ b/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
|
| @@ -199,7 +199,6 @@ void WebPluginContainerImpl::hide()
|
|
|
| void WebPluginContainerImpl::handleEvent(Event* event)
|
| {
|
| - RawPtr<WebPluginContainerImpl> protector(this);
|
| // The events we pass are defined at:
|
| // http://devedge-temp.mozilla.org/library/manuals/2002/plugin/1.0/structures5.html#1000000
|
| // Don't take the documentation as truth, however. There are many cases
|
| @@ -398,13 +397,13 @@ WebElement WebPluginContainerImpl::element()
|
|
|
| void WebPluginContainerImpl::dispatchProgressEvent(const WebString& type, bool lengthComputable, unsigned long long loaded, unsigned long long total, const WebString& url)
|
| {
|
| - RawPtr<ProgressEvent> event;
|
| + ProgressEvent* event;
|
| if (url.isEmpty()) {
|
| event = ProgressEvent::create(type, lengthComputable, loaded, total);
|
| } else {
|
| event = ResourceProgressEvent::create(type, lengthComputable, loaded, total, url);
|
| }
|
| - m_element->dispatchEvent(event.release());
|
| + m_element->dispatchEvent(event);
|
| }
|
|
|
| void WebPluginContainerImpl::invalidate()
|
| @@ -617,12 +616,6 @@ v8::Local<v8::Object> WebPluginContainerImpl::scriptableObject(v8::Isolate* isol
|
| return v8::Local<v8::Object>();
|
| #endif
|
|
|
| - // The plugin may be destroyed due to re-entrancy when calling
|
| - // v8ScriptableObject below. crbug.com/458776. Hold a reference to the
|
| - // plugin container to prevent this from happening. For Oilpan, 'this'
|
| - // is already stack reachable, so redundant.
|
| - RawPtr<WebPluginContainerImpl> protector(this);
|
| -
|
| v8::Local<v8::Object> object = m_webPlugin->v8ScriptableObject(isolate);
|
|
|
| // If the plugin has been destroyed and the reference on the stack is the
|
|
|