Fix race condition with windowless plugin buffers. The problem, which is already fixed for Mac, is …

content/browser/plugin_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "base/utf_string_conversions.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_switches.h"
@@ skipping 232 matching lines @@
 
 #if defined(OS_WIN) || defined(OS_MACOSX)
 // Tests if a plugin executing a self deleting script in the context of
 // a synchronous paint event works correctly
 // http://crbug.com/44960
 IN_PROC_BROWSER_TEST_F(PluginTest, SelfDeletePluginInvokeInSynchronousPaint) {
   LoadAndWait(GetURL("execute_script_delete_in_paint.html"));
 }
 #endif
 
+// Tests that if a plugin executes a self resizing script in the context of a
+// synchronous paint, the plugin doesn't use deallocated memory.
+// http://crbug.com/139462
+IN_PROC_BROWSER_TEST_F(PluginTest, ResizeDuringPaint) {
+  LoadAndWait(GetURL("resize_during_paint.html"));
+}
+
 IN_PROC_BROWSER_TEST_F(PluginTest, SelfDeletePluginInNewStream) {
   LoadAndWait(GetURL("self_delete_plugin_stream.html"));
 }
 
 // This test asserts on Mac in plugin_host in the NPNVWindowNPObject case.
 #if !(defined(OS_MACOSX) && !defined(NDEBUG))
 // If this test flakes use http://crbug.com/95558.
 IN_PROC_BROWSER_TEST_F(PluginTest, DeletePluginInDeallocate) {
   LoadAndWait(GetURL("plugin_delete_in_deallocate.html"));
 }
@@ skipping 185 matching lines @@
 IN_PROC_BROWSER_TEST_F(PluginTest, DISABLED_Java) {
   TestPlugin("Java.html");
 }
 
 IN_PROC_BROWSER_TEST_F(PluginTest, Silverlight) {
   TestPlugin("silverlight.html");
 }
 #endif  // defined(OS_WIN)
 
 }  // namespace content