Merge r181864 - Source/WebKit2:

Make platform/mac-wk2/plugins/destroy-during-async-npp-new.html work again.
https://bugs.webkit.org/show_bug.cgi?id=133692
rdar://problem/17255947

Reviewed by Alexey Proskuryakov.

Add plug-in destruction protectors around message receiver code that can call out to NPObjects or JavaScript
where we need the plug-in to stay around after the call.

* Shared/Plugins/NPObjectMessageReceiver.cpp:
(WebKit::NPObjectMessageReceiver::invoke):
(WebKit::NPObjectMessageReceiver::invokeDefault):
(WebKit::NPObjectMessageReceiver::getProperty):
(WebKit::NPObjectMessageReceiver::setProperty):
(WebKit::NPObjectMessageReceiver::construct):

LayoutTests:
Make platform/mac-wk2/plugins/destroy-during-async-npp-new.html work again
https://bugs.webkit.org/show_bug.cgi?id=133692
rdar://problem/17255947

Reviewed by Alexey Proskuryakov.

* platform/mac-wk2/TestExpectations:
Unskip test.

LayoutTests/ChangeLog

@@ -1,3 +1,14 @@
+2015-03-23  Anders Carlsson  <andersca@apple.com>
+
+        Make platform/mac-wk2/plugins/destroy-during-async-npp-new.html work again
+        https://bugs.webkit.org/show_bug.cgi?id=133692
+        rdar://problem/17255947
+
+        Reviewed by Alexey Proskuryakov.
+
+        * platform/mac-wk2/TestExpectations:
+        Unskip test.
+
 2015-03-19  Enrica Casucci  <enrica@apple.com>
 
         REGRESSION (r109593): Clicking after last inline element could cause a crash.

LayoutTests/platform/mac-wk2/TestExpectations

@@ -244,8 +244,6 @@ webkit.org/b/134550 [ Mavericks Yosemite ] http/tests/cache/iframe-304-crash.htm
 # testRunner.setUseDeferredFrameLoading is not implemented.
 webkit.org/b/93980 http/tests/appcache/load-from-appcache-defer-resume-crash.html [ Skip ]
 
-webkit.org/b/133692 platform/mac-wk2/plugins/destroy-during-async-npp-new.html [ Skip ]
-
 webkit.org/b/136554 platform/mac-wk2/tiled-drawing/scrolling/frames/frameset-nested-frame-scrollability.html [ Pass Failure ]
 webkit.org/b/139901 platform/mac-wk2/tiled-drawing/scrolling/frames/frameset-frame-scrollability.html [ Pass Failure ]
 

Source/WebKit2/ChangeLog

@@ -1,3 +1,21 @@
+2015-03-23  Anders Carlsson  <andersca@apple.com>
+
+        Make platform/mac-wk2/plugins/destroy-during-async-npp-new.html work again.
+        https://bugs.webkit.org/show_bug.cgi?id=133692
+        rdar://problem/17255947
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add plug-in destruction protectors around message receiver code that can call out to NPObjects or JavaScript
+        where we need the plug-in to stay around after the call.
+
+        * Shared/Plugins/NPObjectMessageReceiver.cpp:
+        (WebKit::NPObjectMessageReceiver::invoke):
+        (WebKit::NPObjectMessageReceiver::invokeDefault):
+        (WebKit::NPObjectMessageReceiver::getProperty):
+        (WebKit::NPObjectMessageReceiver::setProperty):
+        (WebKit::NPObjectMessageReceiver::construct):
+
 2015-03-23  Zan Dobersek  <zdobersek@igalia.com>
 
         [GTK] Use std::abs() in ClickCounter::currentClickCountForGdkButtonEvent()

Source/WebKit2/Shared/Plugins/NPObjectMessageReceiver.cpp

@@ -32,6 +32,8 @@
 #include "NPRemoteObjectMap.h"
 #include "NPRuntimeUtilities.h"
 #include "NPVariantData.h"
+#include "Plugin.h"
+#include "PluginController.h"
 
 namespace WebKit {
 
@@ -80,6 +82,8 @@ void NPObjectMessageReceiver::invoke(const NPIdentifierData& methodNameData, con
     NPVariant result;
     VOID_TO_NPVARIANT(result);
 
+    PluginController::PluginDestructionProtector protector(m_plugin->controller());
+
     returnValue = m_npObject->_class->invoke(m_npObject, methodNameData.createNPIdentifier(), arguments.data(), arguments.size(), &result);
     if (returnValue) {
         // Convert the NPVariant to an NPVariantData.
@@ -108,6 +112,8 @@ void NPObjectMessageReceiver::invokeDefault(const Vector<NPVariantData>& argumen
     NPVariant result;
     VOID_TO_NPVARIANT(result);
 
+    PluginController::PluginDestructionProtector protector(m_plugin->controller());
+
     returnValue = m_npObject->_class->invokeDefault(m_npObject, arguments.data(), arguments.size(), &result);
     if (returnValue) {
         // Convert the NPVariant to an NPVariantData.
@@ -142,14 +148,15 @@ void NPObjectMessageReceiver::getProperty(const NPIdentifierData& propertyNameDa
     NPVariant result;
     VOID_TO_NPVARIANT(result);
 
+    PluginController::PluginDestructionProtector protector(m_plugin->controller());
+
     returnValue = m_npObject->_class->getProperty(m_npObject, propertyNameData.createNPIdentifier(), &result);
     if (!returnValue)
         return;
 
-    // Convert the NPVariant to an NPVariantData.
+
     resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result, m_plugin);
 
-    // And release the result.
     releaseNPVariantValue(&result);
 }
 
@@ -162,10 +169,10 @@ void NPObjectMessageReceiver::setProperty(const NPIdentifierData& propertyNameDa
 
     NPVariant propertyValue = m_npRemoteObjectMap->npVariantDataToNPVariant(propertyValueData, m_plugin);
 
-    // Set the property.
+    PluginController::PluginDestructionProtector protector(m_plugin->controller());
+
     returnValue = m_npObject->_class->setProperty(m_npObject, propertyNameData.createNPIdentifier(), &propertyValue);
 
-    // And release the value.
     releaseNPVariantValue(&propertyValue);
 }
 
@@ -213,17 +220,15 @@ void NPObjectMessageReceiver::construct(const Vector<NPVariantData>& argumentsDa
     NPVariant result;
     VOID_TO_NPVARIANT(result);
 
+    PluginController::PluginDestructionProtector protector(m_plugin->controller());
+
     returnValue = m_npObject->_class->construct(m_npObject, arguments.data(), arguments.size(), &result);
-    if (returnValue) {
-        // Convert the NPVariant to an NPVariantData.
+    if (returnValue)
         resultData = m_npRemoteObjectMap->npVariantToNPVariantData(result, m_plugin);
-    }
 
-    // Release all arguments.
     for (size_t i = 0; i < argumentsData.size(); ++i)
         releaseNPVariantValue(&arguments[i]);
 
-    // And release the result.
     releaseNPVariantValue(&result);
 }