Fix possible iterator corruption in Carbon plugin idle event handling

webkit/glue/plugins/webplugin_delegate_impl_mac.mm

Index: webkit/glue/plugins/webplugin_delegate_impl_mac.mm
diff --git a/webkit/glue/plugins/webplugin_delegate_impl_mac.mm b/webkit/glue/plugins/webplugin_delegate_impl_mac.mm
index 1b50c12ec4de1d8bf9d12b90fdfd797e609b79c9..44800c960ded3f955ea270067fa02c20360d977e 100644
--- a/webkit/glue/plugins/webplugin_delegate_impl_mac.mm
+++ b/webkit/glue/plugins/webplugin_delegate_impl_mac.mm
@@ -142,8 +142,12 @@ class CarbonIdleEventSource {
   void SendIdleEventsToDelegates(
       const std::set<WebPluginDelegateImpl*>& delegates) const {
     for (std::set<WebPluginDelegateImpl*>::iterator i = delegates.begin();
-         i != delegates.end(); ++i) {
-      (*i)->FireIdleEvent();
+         i != delegates.end();) {
+      // If the plugin changes size or position during idle event handling, it
+      // may be removed from this set; increment the iterator before calling
+      // into the delegate to ensure that the iteration won't be corrupted.
+      WebPluginDelegateImpl* delegate = *(i++);
+      delegate->FireIdleEvent();
     }
   }