Fix possible iterator corruption in Carbon plugin idle event handling

webkit/glue/plugins/webplugin_delegate_impl_mac.mm

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import <Cocoa/Cocoa.h>
 
 #include "webkit/glue/plugins/webplugin_delegate_impl.h"
 
 #include <string>
 #include <unistd.h>
@@ skipping 124 matching lines @@
     SendIdleEventsToDelegates(visible_delegates_);
   }
 
   void SendHiddenPluginEvents() {
     SendIdleEventsToDelegates(hidden_delegates_);
   }
 
   void SendIdleEventsToDelegates(
       const std::set<WebPluginDelegateImpl*>& delegates) const {
     for (std::set<WebPluginDelegateImpl*>::iterator i = delegates.begin();
-         i != delegates.end(); ++i) {
-      (*i)->FireIdleEvent();
+         i != delegates.end();) {
+      // If the plugin changes size or position during idle event handling, it
+      // may be removed from this set; increment the iterator before calling
+      // into the delegate to ensure that the iteration won't be corrupted.
+      WebPluginDelegateImpl* delegate = *(i++);
+      delegate->FireIdleEvent();
     }
   }
 
   base::RepeatingTimer<CarbonIdleEventSource> visible_timer_;
   base::RepeatingTimer<CarbonIdleEventSource> hidden_timer_;
   std::set<WebPluginDelegateImpl*> visible_delegates_;
   std::set<WebPluginDelegateImpl*> hidden_delegates_;
 };
 #endif  // !NP_NO_CARBON
 
@@ skipping 832 matching lines @@
 #ifndef NP_NO_QUICKDRAW
   // Quickdraw-based plugins can draw at any time, so tell the renderer to
   // repaint.
   // TODO: only do this if the contents of the offscreen window has changed,
   // so as not to spam the renderer with an unchanging image.
   if (instance()->drawing_model() == NPDrawingModelQuickDraw)
     instance()->webplugin()->Invalidate();
 #endif
 }
 #endif  // !NP_NO_CARBON