Merge 37539 - Fix possible iterator corruption in Carbon plugin idle event ha...

webkit/glue/plugins/webplugin_delegate_impl_mac.mm

Index: webkit/glue/plugins/webplugin_delegate_impl_mac.mm
===================================================================
--- webkit/glue/plugins/webplugin_delegate_impl_mac.mm	(revision 37541)
+++ webkit/glue/plugins/webplugin_delegate_impl_mac.mm	(working copy)
@@ -142,8 +142,12 @@
   void SendIdleEventsToDelegates(
       const std::set<WebPluginDelegateImpl*>& delegates) const {
     for (std::set<WebPluginDelegateImpl*>::iterator i = delegates.begin();
-         i != delegates.end(); ++i) {
-      (*i)->FireIdleEvent();
+         i != delegates.end();) {
+      // If the plugin changes size or position during idle event handling, it
+      // may be removed from this set; increment the iterator before calling
+      // into the delegate to ensure that the iteration won't be corrupted.
+      WebPluginDelegateImpl* delegate = *(i++);
+      delegate->FireIdleEvent();
     }
   }