Johnny Stenback 5537c27fe8 Bug 898906. Fix this bug by making nsMimeType objects hold their active plugin alive, and rely on the cycle collector to break the explicit reference cycle. r=mccr8 ... --- dom/base/crashtests/898906.html | 14 ++++++++++++++ dom/base/crashtests/crashtests.list | 3 ++- dom/base/nsMimeTypeArray.cpp | 2 +- dom/base/nsMimeTypeArray.h | 14 ++++++-------- dom/base/nsPluginArray.cpp | 24 +----------------------- dom/base/nsPluginArray.h | 2 -- 6 files changed, 24 insertions(+), 35 deletions(-) create mode 100644 dom/base/crashtests/898906.html		2013-07-30 17:46:46 -07:00
..
90613-1.html
244933-1.html
275912-1.html
327571-1.html
327695-1.html
329481-1.xhtml
338674-1.xhtml
346381-1.html
359432-1.xhtml
369219-1.xhtml
369413-1.html
371124-1-inner.html
371124-1.html
371124-2-inner.html
371124-2.html
372554-1.html
375399-1-inner.xhtml
375399-1.html
404869-1.xul
417852-1.html
439206-1.html
462947.html
473284.xul
499006-1.html	Add crashtests for bug 499006.	2010-05-12 14:14:54 +02:00
499006-2.html	Add crashtests for bug 499006.	2010-05-12 14:14:54 +02:00
502617.html
504224.html
601247.html	Bug 601247. Don't JSVAL_TO_PRIVATE a random jsval. r=jst, a=jst	2010-10-15 17:55:53 -04:00
603531.html	Add testcase for bug 603531	2010-10-16 22:24:56 -07:00
609560-1.xhtml	Add crashtest from bug 609560	2011-06-20 11:42:05 -07:00
612018-1.html	Bug 612018 - "ASSERTION: frame must not be dirty" and non-blinking caret; r,a=roc	2010-11-16 13:55:25 -05:00
637116.html	Fix for bug 637116 (Leak documents+windows with replaceState, focus, event handler closure). r=mrbkap.	2011-03-03 12:55:55 +01:00
666869.html	Bug 666869 - Crash [@ nsGlobalWindow::GetPerformance]. r=smaug	2011-06-27 00:08:33 +02:00
675621-1.html	Bug 675621 - Reposition update batch to avoid an assertion about removal mutations when inserting a DOM fragment in insertAdjacentHTML. r=Olli.Pettay.	2011-08-05 19:45:31 +03:00
677194.html	Bug 677194 - Add test; r=jst	2012-05-05 11:00:05 +02:00
693811-1.html	Back out 570dd369e02a, bc777c65c5ca and 12a483042e9a to fix bustage	2012-01-27 15:34:30 +01:00
693811-2.html	Back out 570dd369e02a, bc777c65c5ca and 12a483042e9a to fix bustage	2012-01-27 15:34:30 +01:00
693811-3.html	Fix for bug 693811 ("Assertion failure: shouldCacheProtoShape(cx, proto, &shouldCache) && shouldCache" in ListBase::nativeGet). r=mrbkap.	2011-10-14 23:29:36 +02:00
693894.html	Fix for bug 693894 (NodeList crash [@ js::GetObjectShape]). r=jst.	2011-10-13 14:40:20 +02:00
695867.html	Bug 695867 - Crash [@ LookupPropertyById] with getPropertyDescriptor returning a NodeList. r=bz.	2011-10-27 19:31:37 +02:00
697643.html	Bug 697643 - Crash [@ JS_IsExceptionPending] modifying a live NodeList. r=bz.	2011-10-27 19:39:03 +02:00
706283-1.html	Bug 706283. Handle null passed to requestAnimationFrame gracefully. r=roc	2011-12-01 14:24:00 -05:00
708405-1.html	Bug 708405. Make sure to propagate out failures from JS_HasPropertyById in the old nodelist resolve hook. r=mrbkap	2011-12-15 14:36:46 -05:00
745495.html	Bug 745495 - Fix crash when using screen object from removed iframe. r=smaug	2012-04-16 11:33:35 +02:00
844559.html	Fix for bug 844559 (Crash [@ mozilla::dom::XrayResolveNativeProperty]). r=bz.	2013-02-25 20:39:15 +01:00
886213.html	Bug 886213 - Cycle collect Navigator more better. r=smaug	2013-06-28 11:06:39 -07:00
898906.html	Bug 898906. Fix this bug by making nsMimeType objects hold their active plugin alive, and rely on the cycle collector to break the explicit reference cycle. r=mccr8	2013-07-30 17:46:46 -07:00
crashtests.list	Bug 898906. Fix this bug by making nsMimeType objects hold their active plugin alive, and rely on the cycle collector to break the explicit reference cycle. r=mccr8	2013-07-30 17:46:46 -07:00