Oilpan: fix build after r190700 (99fb464b7).

Oilpan: fix build after r190700 (99fb464b7).

The container's is already kept alive by a stack reference with Oilpan.

R=haraken
BUG=458776
NOTRY=true

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=190718

[sof, 2015-02-24 06:41:12]

sigbjornf@opera.com changed reviewers:
+ oilpan-reviews@chromium.org

[sof, 2015-02-24 06:41:12]

Please take a look.

I cannot access the upstream bug, but the lifetime issue here is something you
get "for free" with Oilpan by all accounts.

[haraken, 2015-02-24 06:57:30]

LGTM

[haraken, 2015-02-24 06:57:50]

I can't access the bug either...

[sof, 2015-02-24 07:02:53]

The CQ bit was checked by sigbjornf@opera.com

[commit-bot: I haz the power, 2015-02-24 07:03:15]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/955573002/1

[commit-bot: I haz the power, 2015-02-24 07:04:33]

Committed patchset #1 (id:1) as
https://src.chromium.org/viewvc/blink?view=rev&revision=190718

[sof, 2015-02-24 07:14:39]

On 2015/02/24 06:57:50, haraken wrote:
> I can't access the bug either...

If the helper plugin object is destructed during the problematic call, it'll
dispose() of the plugin container with Oilpan. Which'll reset m_webPlugin, so
this vulnerability wasn't present in Oilpan builds as-was.

[raymes, 2015-02-24 23:55:25]

raymes@chromium.org changed reviewers:
+ raymes@chromium.org

[raymes, 2015-02-24 23:55:26]

https://codereview.chromium.org/955573002/diff/1/Source/web/WebPluginContaine...
File Source/web/WebPluginContainerImpl.cpp (right):

https://codereview.chromium.org/955573002/diff/1/Source/web/WebPluginContaine...
Source/web/WebPluginContainerImpl.cpp:609: if (!m_webPlugin)
Hmm I don't really understand what the problem was here. Could you explain more?
Why does hasOneRef not work (sorry I have no idea what oilpan is!)

In this case we were trying to avoid calling into the plugin if it is about to
be destroyed which seems wise.

[raymes, 2015-02-24 23:59:29]

https://codereview.chromium.org/955573002/diff/1/Source/web/WebPluginContaine...
File Source/web/WebPluginContainerImpl.cpp (right):

https://codereview.chromium.org/955573002/diff/1/Source/web/WebPluginContaine...
Source/web/WebPluginContainerImpl.cpp:609: if (!m_webPlugin)
Actually I think this seems reasonable as it looks like in the case of oilpan
it's possible the plugin may have been destroyed in the re-entrant call.

Thanks!

[sof, 2015-02-25 07:04:50]

Thanks for doublechecking & going over the details.

https://codereview.chromium.org/955573002/diff/1/Source/web/WebPluginContaine...
File Source/web/WebPluginContainerImpl.cpp (right):

https://codereview.chromium.org/955573002/diff/1/Source/web/WebPluginContaine...
Source/web/WebPluginContainerImpl.cpp:609: if (!m_webPlugin)
On 2015/02/24 23:59:29, raymes wrote:
> Actually I think this seems reasonable as it looks like in the case of oilpan
> it's possible the plugin may have been destroyed in the re-entrant call.
> 
> Thanks!

If it ends up being disposed of, m_webPlugin will be cleared.

This container object itself cannot be destructed as it is on the Oilpan heap,
so if a garbage collection should strike across that troublesome call, the
object will be kept alive as the stack refers to it.