One of my coworkers pointed out this snippet of code from ns4xPlugin.cpp in the firefox source tree. I got a kick out of it. The comments crack me up.
#ifdef BROKEN_PLUGIN_HACK
// The broken plugin has wrapped NPN callback function pointers in PPC
// TVector glue as though they were pointers to CFM TVectors. When the
// x86 attempts to execute the PPC glue, it will of course fail.
//
// What's done here is a bit unorthodox. I'm going to locate the
// TVector glue that the plugin created from ns4xPlugin::CALLBACKS by
// peeking into its symbol table, then I'm going to dissect the PPC
// machine code to get the target addresses and produce x86 machine code.
// The x86 code overwrites the PPC code in the plugin's jump table.
// The replacement code is of course executable. I know I can do this,
// because the broken plugin builds its table of TVector glue based on
// what the sample NPAPI plugin does.
//
// Watch this.
