The WebPluginImpl::paint function can be invoked when the delegate_ member is...

webkit/glue/webplugin_impl.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/gfx/rect.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/string_util.h"
 #include "net/base/escape.h"
 #include "skia/ext/platform_canvas.h"
@@ skipping 218 matching lines @@
 void WebPluginImpl::destroy() {
   SetContainer(NULL);
   MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 NPObject* WebPluginImpl::scriptableObject() {
   return delegate_->GetPluginScriptableObject();
 }
 
 void WebPluginImpl::paint(WebCanvas* canvas, const WebRect& paint_rect) {
+  if (!delegate_)
+    return;
   // Note that |context| is only used when in windowless mode.
 #if WEBKIT_USING_SKIA
   gfx::NativeDrawingContext context = canvas->beginPlatformPaint();
 #elif WEBKIT_USING_CG
   gfx::NativeDrawingContext context = canvas;
 #endif
 
   delegate_->Paint(context, paint_rect);
 
 #if WEBKIT_USING_SKIA
@@ skipping 803 matching lines @@
     client_index = clients_.erase(client_index);
   }
 
   // This needs to be called now and not in the destructor since the
   // webframe_ might not be valid anymore.
   webframe_ = NULL;
   method_factory_.RevokeAll();
 }
 
 }  // namespace webkit_glue