diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp index 1742dbc19181..703fc48f16c7 100644 --- a/dom/plugins/base/nsNPAPIPlugin.cpp +++ b/dom/plugins/base/nsNPAPIPlugin.cpp @@ -1254,12 +1254,22 @@ _retainobject(NPObject* npobj) void _releaseobject(NPObject* npobj) { + // If nothing is passed, just return, even if we're on the wrong thread. + if (!npobj) { + return; + } + + // THIS IS A KNOWN LEAK. SEE BUG 1221448. + // If releaseobject is called off the main thread and we have a valid pointer, + // we at least know it was created on the main thread (see _createobject + // implementation). However, forwarding the deletion back to the main thread + // without careful checking could cause bad memory management races. So, for + // now, we leak by warning and then just returning early. But it should fix + // java 7 crashes. if (!NS_IsMainThread()) { NPN_PLUGIN_LOG(PLUGIN_LOG_ALWAYS,("NPN_releaseobject called from the wrong thread\n")); - MOZ_CRASH("NPN_releaseobject called from the wrong thread"); - } - if (!npobj) return; + } int32_t refCnt = PR_ATOMIC_DECREMENT((int32_t*)&npobj->referenceCount); NS_LOG_RELEASE(npobj, refCnt, "BrowserNPObject");