Fix for EXT-4207 (Viewer crash clicking on an object that starts a script that navigates in a while(1) loop)

Don't allow LLViewerMediaImpl to process a navigateInternal during the call to LLPluginClassMedia::idle().  This prevents untimely destruction of the LLPluginClassMedia and LLPluginMessagePipe objects, which was causing the crash.

Reviewed by Rick.

2 files changed, 41 insertions, 0 deletions

diff --git a/indra/newview/llviewermedia.cpp b/indra/newview/llviewermedia.cpp
index 023c288d92..1d07b5d489 100644
--- a/indra/newview/llviewermedia.cpp
+++ b/indra/newview/llviewermedia.cpp
@@ -1006,6 +1006,8 @@ LLViewerMediaImpl::LLViewerMediaImpl(	  const LLUUID& texture_id,
 	mInNearbyMediaList(false),
 	mClearCache(false),
 	mBackgroundColor(LLColor4::white),
+	mNavigateSuspended(false),
+	mNavigateSuspendedDeferred(false),
 	mIsUpdated(false)
 { 
 
@@ -1696,6 +1698,13 @@ void LLViewerMediaImpl::navigateInternal()
 	// Helpful to have media urls in log file. Shouldn't be spammy.
 	llinfos << "media id= " << mTextureId << " url=" << mMediaURL << " mime_type=" << mMimeType << llendl;
 
+	if(mNavigateSuspended)
+	{
+		llwarns << "Deferring navigate." << llendl;
+		mNavigateSuspendedDeferred = true;
+		return;
+	}
+	
 	if(mMimeTypeProbe != NULL)
 	{
 		llwarns << "MIME type probe already in progress -- bailing out." << llendl;
@@ -1902,7 +1911,17 @@ void LLViewerMediaImpl::update()
 		return;
 	}
 	
+	// Make sure a navigate doesn't happen during the idle -- it can cause mMediaSource to get destroyed, which can cause a crash.
+	setNavigateSuspended(true);
+	
 	mMediaSource->idle();
+
+	setNavigateSuspended(false);
+
+	if(mMediaSource == NULL)
+	{
+		return;
+	}
 	
 	if(mMediaSource->isPluginExited())
 	{
@@ -2559,6 +2578,23 @@ void LLViewerMediaImpl::setNavState(EMediaNavState state)
 	}
 }
 
+void LLViewerMediaImpl::setNavigateSuspended(bool suspend)
+{
+	if(mNavigateSuspended != suspend)
+	{
+		mNavigateSuspended = suspend;
+		if(!suspend)
+		{
+			// We're coming out of suspend.  If someone tried to do a navigate while suspended, do one now instead.
+			if(mNavigateSuspendedDeferred)
+			{
+				mNavigateSuspendedDeferred = false;
+				navigateInternal();
+			}
+		}
+	}
+}
+
 void LLViewerMediaImpl::cancelMimeTypeProbe()
 {
 	if(mMimeTypeProbe != NULL)
diff --git a/indra/newview/llviewermedia.h b/indra/newview/llviewermedia.h
index 8a5cd804aa..668f3b563d 100644
--- a/indra/newview/llviewermedia.h
+++ b/indra/newview/llviewermedia.h
@@ -326,6 +326,9 @@ public:
 	EMediaNavState getNavState() { return mMediaNavState; }
 	void setNavState(EMediaNavState state);
 	
+	void setNavigateSuspended(bool suspend);
+	bool isNavigateSuspended() { return mNavigateSuspended; };
+	
 	void cancelMimeTypeProbe();
 private:
 	// a single media url with some data and an impl.
@@ -372,6 +375,8 @@ private:
 	bool mInNearbyMediaList;	// used by LLFloaterNearbyMedia::refreshList() for performance reasons
 	bool mClearCache;
 	LLColor4 mBackgroundColor;
+	bool mNavigateSuspended;
+	bool mNavigateSuspendedDeferred;
 	
 private:
 	BOOL mIsUpdated ;