Bug 751885 - Cancel pending events when plugin is destroyed on Android r=blassey

dom/plugins/base/android/ANPEvent.cpp

@@ -47,31 +47,14 @@
 #define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "GeckoPlugins" , ## args)
 #define ASSIGN(obj, name)   (obj)->name = anp_event_##name
 
-class PluginEventRunnable : public nsRunnable
-{
-public:
-  PluginEventRunnable(NPP inst, ANPEvent* event, NPPluginFuncs* aFuncs)
-    : mInstance(inst), mEvent(*event), mFuncs(aFuncs) {}
-  virtual nsresult Run() {
-    (*mFuncs->event)(mInstance, &mEvent);
-    return NS_OK;
-  }
-private:
-  NPP mInstance;
-  ANPEvent mEvent;
-  NPPluginFuncs* mFuncs;
-};
-
 void
-anp_event_postEvent(NPP inst, const ANPEvent* event)
+anp_event_postEvent(NPP instance, const ANPEvent* event)
 {
   LOG("%s", __PRETTY_FUNCTION__);
 
-  nsNPAPIPluginInstance* pinst = static_cast<nsNPAPIPluginInstance*>(inst->ndata);
-  NPPluginFuncs* pluginFunctions = pinst->GetPlugin()->PluginFuncs();
-  PluginEventRunnable* e = new PluginEventRunnable(inst, const_cast<ANPEvent*>(event), pluginFunctions);
+  nsNPAPIPluginInstance* pinst = static_cast<nsNPAPIPluginInstance*>(instance->ndata);
+  pinst->PostEvent((void*) event);
   
-  NS_DispatchToMainThread(e);
   LOG("returning from %s", __PRETTY_FUNCTION__);
 }
 

dom/plugins/base/nsNPAPIPluginInstance.cpp

@@ -69,6 +69,29 @@
 #include "mozilla/Mutex.h"
 #include "mozilla/CondVar.h"
 #include "AndroidBridge.h"
+
+class PluginEventRunnable : public nsRunnable
+{
+public:
+  PluginEventRunnable(nsNPAPIPluginInstance* instance, ANPEvent* event)
+    : mInstance(instance), mEvent(*event), mCanceled(false) {}
+
+  virtual nsresult Run() {
+    if (mCanceled)
+      return NS_OK;
+
+    mInstance->HandleEvent(&mEvent, nsnull);
+    mInstance->PopPostedEvent(this);
+    return NS_OK;
+  }
+
+  void Cancel() { mCanceled = true; }
+private:
+  nsNPAPIPluginInstance* mInstance;
+  ANPEvent mEvent;
+  bool mCanceled;
+};
+
 #endif
 
 using namespace mozilla;
@@ -215,6 +238,14 @@ nsresult nsNPAPIPluginInstance::Stop()
   }
   mRunning = DESTROYED;
 
+#if MOZ_WIDGET_ANDROID
+  for (PRUint32 i = 0; i < mPostedEvents.Length(); i++) {
+    mPostedEvents[i]->Cancel();
+  }
+
+  mPostedEvents.Clear();
+#endif
+
   nsJSNPRuntime::OnPluginDestroy(&mNPP);
 
   if (error != NPERR_NO_ERROR)
@@ -792,6 +823,19 @@ void nsNPAPIPluginInstance::RequestJavaSurface()
   ((SurfaceGetter*)mSurfaceGetter.get())->RequestSurface();
 }
 
+void nsNPAPIPluginInstance::PostEvent(void* event)
+{
+  PluginEventRunnable *r = new PluginEventRunnable(this, (ANPEvent*)event);
+  mPostedEvents.AppendElement(nsRefPtr<PluginEventRunnable>(r));
+
+  NS_DispatchToMainThread(r);
+}
+
+void nsNPAPIPluginInstance::PopPostedEvent(PluginEventRunnable* r)
+{
+  mPostedEvents.RemoveElement(r);
+}
+
 #endif
 
 nsresult nsNPAPIPluginInstance::GetDrawingModel(PRInt32* aModel)

dom/plugins/base/nsNPAPIPluginInstance.h

@@ -51,6 +51,7 @@
 #include "nsHashKeys.h"
 #ifdef MOZ_WIDGET_ANDROID
 #include "nsIRunnable.h"
+class PluginEventRunnable;
 #endif
 
 #include "mozilla/TimeStamp.h"
@@ -100,9 +101,6 @@ public:
   nsresult SetWindow(NPWindow* window);
   nsresult NewStreamFromPlugin(const char* type, const char* target, nsIOutputStream* *result);
   nsresult Print(NPPrint* platformPrint);
-#ifdef MOZ_WIDGET_ANDROID
-  nsresult PostEvent(void* event) { return 0; };
-#endif
   nsresult HandleEvent(void* event, PRInt16* result);
   nsresult GetValueFromPlugin(NPPVariable variable, void* value);
   nsresult GetDrawingModel(PRInt32* aModel);
@@ -170,6 +168,8 @@ public:
   void* GetJavaSurface();
   void SetJavaSurface(void* aSurface);
   void RequestJavaSurface();
+
+  void PostEvent(void* event);
 #endif
 
   nsresult NewStreamListener(const char* aURL, void* notifyData,
@@ -249,6 +249,11 @@ protected:
 #ifdef MOZ_WIDGET_ANDROID
   PRUint32 mANPDrawingModel;
   nsCOMPtr<nsIRunnable> mSurfaceGetter;
+
+  friend class PluginEventRunnable;
+
+  nsTArray<nsCOMPtr<PluginEventRunnable>> mPostedEvents;
+  void PopPostedEvent(PluginEventRunnable* r);
 #endif
 
   enum {