[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

[andersca at apple.com]

The following commit has been merged in the debian/experimental branch:
commit 0a7d4d1b6252b772b8068f41704ad3edf58c464c
Author: andersca at apple.com <andersca at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Jul 15 20:23:16 2010 +0000

    Don't allow multiple calls to NetscapePluginStream::stop
    https://bugs.webkit.org/show_bug.cgi?id=42395
    
    Reviewed by Sam Weinig.
    
    * WebProcess/Plugins/Netscape/NetscapePluginStream.cpp:
    (WebKit::NetscapePluginStream::NetscapePluginStream):
    Initialize m_urlNotifyHasBeenCalled.
    
    (WebKit::NetscapePluginStream::~NetscapePluginStream):
    Assert that the stream didn't need a URL notification or that one was sent.
    
    (WebKit::NetscapePluginStream::sendJavaScriptStream):
    Don't call stop in the JS failure case because the stream won't be started.
    
    (WebKit::NetscapePluginStream::stop):
    Remove m_isStarted check and add an assertion instead. Move code that calls NPP_URLNotify and
    destroys the stream out to a separate function.
    
    (WebKit::NetscapePluginStream::notifyAndDestroyStream):
    Call NPP_URLNotify if necessary and destroy the stream.
    
    * WebProcess/Plugins/Netscape/NetscapePluginStream.h:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@63453 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebKit2/ChangeLog b/WebKit2/ChangeLog
index 651ca0f..d74b511 100644
--- a/WebKit2/ChangeLog
+++ b/WebKit2/ChangeLog
@@ -2,6 +2,32 @@
 
         Reviewed by Sam Weinig.
 
+        Don't allow multiple calls to NetscapePluginStream::stop
+        https://bugs.webkit.org/show_bug.cgi?id=42395
+
+        * WebProcess/Plugins/Netscape/NetscapePluginStream.cpp:
+        (WebKit::NetscapePluginStream::NetscapePluginStream):
+        Initialize m_urlNotifyHasBeenCalled.
+
+        (WebKit::NetscapePluginStream::~NetscapePluginStream):
+        Assert that the stream didn't need a URL notification or that one was sent.
+
+        (WebKit::NetscapePluginStream::sendJavaScriptStream):
+        Don't call stop in the JS failure case because the stream won't be started.
+
+        (WebKit::NetscapePluginStream::stop):
+        Remove m_isStarted check and add an assertion instead. Move code that calls NPP_URLNotify and
+        destroys the stream out to a separate function.
+
+        (WebKit::NetscapePluginStream::notifyAndDestroyStream):
+        Call NPP_URLNotify if necessary and destroy the stream.
+
+        * WebProcess/Plugins/Netscape/NetscapePluginStream.h:
+
+2010-07-15  Anders Carlsson  <andersca at apple.com>
+
+        Reviewed by Sam Weinig.
+
         Implement NPN_DestroyStream
         https://bugs.webkit.org/show_bug.cgi?id=42393
 
diff --git a/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp b/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
index a2dd090..c4b5719 100644
--- a/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
+++ b/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
@@ -42,6 +42,9 @@ NetscapePluginStream::NetscapePluginStream(PassRefPtr<NetscapePlugin> plugin, ui
     , m_transferMode(NP_NORMAL)
     , m_offset(0)
     , m_isStarted(false)
+#if !ASSERT_DISABLED
+    , m_urlNotifyHasBeenCalled(false)
+#endif    
     , m_deliveryDataTimer(RunLoop::main(), this, &NetscapePluginStream::deliverDataToPlugin)
     , m_stopStreamWhenDoneDelivering(false)
 {
@@ -50,6 +53,7 @@ NetscapePluginStream::NetscapePluginStream(PassRefPtr<NetscapePlugin> plugin, ui
 NetscapePluginStream::~NetscapePluginStream()
 {
     ASSERT(!m_isStarted);
+    ASSERT(!m_sendNotification || m_urlNotifyHasBeenCalled);
 }
 
 void NetscapePluginStream::sendJavaScriptStream(const String& requestURLString, const String& result)
@@ -60,8 +64,8 @@ void NetscapePluginStream::sendJavaScriptStream(const String& requestURLString,
 
     CString resultCString = requestURLString.utf8();
     if (resultCString.isNull()) {
-        // There was an error evaluating the JavaScript, just call stop.
-        stop(NPRES_NETWORK_ERR);
+        // There was an error evaluating the JavaScript, call NPP_URLNotify if needed and then destroy the stream.
+        notifyAndDestroyStream(NPRES_NETWORK_ERR);
         return;
     }
 
@@ -198,34 +202,43 @@ void NetscapePluginStream::deliverDataToPlugin()
 
 void NetscapePluginStream::stop(NPReason reason)
 {
-    if (!m_isStarted)
+    ASSERT(m_isStarted);
+
+    if (reason == NPRES_DONE && m_deliveryData && !m_deliveryData->isEmpty()) {
+        // There is still data left that the plug-in hasn't been able to consume yet.
+        ASSERT(m_deliveryDataTimer.isActive());
+        
+        // Set m_stopStreamWhenDoneDelivering to true so that the next time the delivery timer fires
+        // and calls deliverDataToPlugin the stream will be closed if all the remaining data was
+        // successfully delivered.
+        m_stopStreamWhenDoneDelivering = true;
         return;
+    }
 
-    if (m_isStarted) {
-        if (reason == NPRES_DONE && m_deliveryData && !m_deliveryData->isEmpty()) {
-            // There is still data left that the plug-in hasn't been able to consume yet.
-            ASSERT(m_deliveryDataTimer.isActive());
-            
-            // Set m_stopStreamWhenDoneDelivering to true so that the next time the delivery timer fires
-            // and calls deliverDataToPlugin the stream will be closed if all the remaining data was
-            // successfully delivered.
-            m_stopStreamWhenDoneDelivering = true;
-            return;
-        }
+    m_deliveryData = 0;
+    m_deliveryDataTimer.stop();
 
-        m_deliveryData = 0;
-        m_deliveryDataTimer.stop();
+    // Set m_isStarted to false before calling NPP_DestroyStream in case NPP_DestroyStream calls NPN_DestroyStream.
+    m_isStarted = false;
 
-        // Set m_isStarted to false before calling NPP_DestroyStream in case NPP_DestroyStream calls NPN_DestroyStream.
-        m_isStarted = false;
+    m_plugin->NPP_DestroyStream(&m_npStream, reason);
 
-        m_plugin->NPP_DestroyStream(&m_npStream, reason);
-    }
+    notifyAndDestroyStream(reason);
+}
 
+void NetscapePluginStream::notifyAndDestroyStream(NPReason reason)
+{
+    ASSERT(!m_isStarted);
     ASSERT(!m_deliveryDataTimer.isActive());
-
-    if (m_sendNotification)
+    ASSERT(!m_urlNotifyHasBeenCalled);
+    
+    if (m_sendNotification) {
         m_plugin->NPP_URLNotify(m_responseURL.data(), reason, m_notificationData);
+    
+#if !ASSERT_DISABLED
+        m_urlNotifyHasBeenCalled = true;
+#endif    
+    }
 
     m_plugin->removePluginStream(this);
 }
diff --git a/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h b/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h
index 1a937ef..260918d 100644
--- a/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h
+++ b/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h
@@ -63,6 +63,8 @@ private:
                uint32_t lastModifiedTime, const WebCore::String& mimeType, const WebCore::String& headers);
     void stop(NPReason);
 
+    void notifyAndDestroyStream(NPReason);
+
     void deliverData(const char* bytes, int length);
     void deliverDataToPlugin();
 
@@ -79,6 +81,10 @@ private:
     // Whether NPP_NewStream has successfully been called.
     bool m_isStarted;
 
+#if !ASSERT_DISABLED
+    bool m_urlNotifyHasBeenCalled;
+#endif
+
     CString m_responseURL;
     CString m_mimeType;
     CString m_headers;

-- 
WebKit Debian packaging