Watch out for invalid delegate and container after destroying the WebViewPlugin.

webkit/glue/plugins/webview_plugin.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/glue/plugins/webview_plugin.h"
 
 #include "base/message_loop.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebCursorInfo.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebPluginContainer.h"
@@ skipping 37 matching lines @@
 }
 
 bool WebViewPlugin::initialize(WebPluginContainer* container) {
   container_ = container;
   return true;
 }
 
 void WebViewPlugin::destroy() {
   delegate_->WillDestroyPlugin();
   delegate_ = NULL;
+  container_ = NULL;
   MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 void WebViewPlugin::paint(WebCanvas* canvas, const WebRect& rect) {
   gfx::Rect paintRect(rect_.Intersect(rect));
   if (paintRect.IsEmpty())
     return;
 
   paintRect.Offset(-rect_.x(), -rect_.y());
 
@@ skipping 39 matching lines @@
 void WebViewPlugin::startDragging(const WebDragData&,
                                   WebDragOperationsMask,
                                   const WebImage&,
                                   const WebPoint&) {
   // Immediately stop dragging.
   web_view_->dragSourceSystemDragEnded();
 }
 
 void WebViewPlugin::didInvalidateRect(const WebRect& rect) {
   if (container_)
-    container_->invalidateRect(WebRect(rect));
+    container_->invalidateRect(rect);
 }
 
 void WebViewPlugin::didChangeCursor(const WebCursorInfo& cursor) {
   current_cursor_ = cursor;
 }
 
 void WebViewPlugin::didClearWindowObject(WebFrame* frame) {
-  delegate_->BindWebFrame(frame);
+  if (delegate_)
+    delegate_->BindWebFrame(frame);
 }
 
 bool WebViewPlugin::canHandleRequest(WebFrame* frame,
                                      const WebURLRequest& request) {
   return GURL(request.url()).SchemeIs("chrome");
 }
 
 WebURLError WebViewPlugin::cancelledError(WebFrame* frame,
                                           const WebURLRequest& request) {
   // Return an error with a non-zero reason so isNull() on the corresponding
   // ResourceError is false.
   WebURLError error;
   error.domain = "WebViewPlugin";
   error.reason = -1;
   error.unreachableURL = request.url();
   return error;
 }