Add checks for Mac plugin instance destruction after NPP_* calls

webkit/glue/plugins/webplugin_delegate_impl_mac.mm

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import <Cocoa/Cocoa.h>
 
 #include "webkit/glue/plugins/webplugin_delegate_impl.h"
 
 #include <string>
 #include <unistd.h>
@@ skipping 549 matching lines @@
   // is actually being called in all the cases it should be, at which point
   // we'll know whether or not that's handled for us by WebKit.
   if (!is_visible)
     FocusChanged(false);
 
   // If the plugin is changing visibility, let the plugin know. If it's scrolled
   // off screen (i.e., clip_rect_ is empty), then container visibility doesn't
   // change anything.
   if (!clip_rect_.IsEmpty()) {
 #ifndef NP_NO_CARBON
-    if (instance()->event_model() == NPEventModelCarbon)
+    if (instance() && instance()->event_model() == NPEventModelCarbon)
       UpdateIdleEventRate();
 #endif
     WindowlessSetWindow(true);
   }
 }
 
 void WebPluginDelegateImpl::WindowFrameChanged(gfx::Rect window_frame,
                                                gfx::Rect view_frame) {
   instance()->set_window_frame(window_frame);
   SetContentAreaOrigin(gfx::Point(view_frame.x(), view_frame.y()));
@@ skipping 361 matching lines @@
       SetContentAreaOrigin(content_area_origin_);
     }
 
     current_windowless_cursor_.GetCursorInfo(cursor_info);
   }
 
   // if we do not currently have focus and this is a mouseDown, trigger a
   // notification that we are taking the keyboard focus.  We can't just key
   // off of incoming calls to SetFocus, since WebKit may already think we
   // have it if we were the most recently focused element on our parent tab.
-  if (event.type == WebInputEvent::MouseDown && !have_focus_)
+  if (event.type == WebInputEvent::MouseDown && !have_focus_) {
     SetFocus();
+    // Make sure that the plugin is still there after handling the focus event.
+    if (!instance())
+      return false;
+  }
 
 #ifndef NP_NO_CARBON
   if (instance()->event_model() == NPEventModelCarbon) {
     if (event.type == WebInputEvent::MouseMove) {
       return true;  // The recurring OnNull will send null events.
     }
 
     switch (instance()->drawing_model()) {
 #ifndef NP_NO_QUICKDRAW
       case NPDrawingModelQuickDraw:
@@ skipping 46 matching lines @@
 
   if (WebInputEventIsWebMouseEvent(event)) {
     // Plugins are not good about giving accurate information about whether or
     // not they handled events, and other browsers on the Mac generally ignore
     // the return value. We may need to expand this to other input types, but
     // we'll need to be careful about things like Command-keys.
     ret = true;
   }
 
 #ifndef NP_NO_CARBON
-  if (instance()->event_model() == NPEventModelCarbon &&
+  if (instance() && instance()->event_model() == NPEventModelCarbon &&
       instance()->drawing_model() == NPDrawingModelCoreGraphics &&
       cg_context_.context == old_context_weak)
     CGContextRestoreGState(cg_context_.context);
 #endif
 
   return ret;
 }
 
 #ifndef NP_NO_CARBON
 void WebPluginDelegateImpl::FireIdleEvent() {
   // Avoid a race condition between IO and UI threads during plugin shutdown
-  if (!instance_)
+  if (!instance())
     return;
 
   ScopedActiveDelegate active_delegate(this);
 
   if (!webkit_glue::IsPluginRunningInRendererProcess()) {
     switch (instance()->event_model()) {
       case NPEventModelCarbon:
         // If the plugin is running in a subprocess, drain any pending system
         // events so that the plugin's event handlers will get called on any
         // windows it has created.  Filter out activate/deactivate events on
         // the fake browser window, but pass everything else through.
         EventRecord event;
         while (GetNextEvent(everyEvent, &event)) {
           if (event.what == activateEvt && cg_context_.window &&
               reinterpret_cast<void *>(event.message) != cg_context_.window)
             continue;
           instance()->NPP_HandleEvent(&event);
+          // If the plugin went away during event handling, we're done.
+          if (!instance())
+            return;
         }
         break;
     }
   }
 
   if (instance()->event_model() == NPEventModelCarbon) {
     // Send an idle event so that the plugin can do background work
     NPEvent np_event = {0};
     np_event.what = nullEvent;
     np_event.when = TickCount();
     np_event.modifiers = GetCurrentKeyModifiers();
     if (!Button())
       np_event.modifiers |= btnState;
     HIPoint mouse_location;
     HIGetMousePosition(kHICoordSpaceScreenPixel, NULL, &mouse_location);
     np_event.where.h = mouse_location.x;
     np_event.where.v = mouse_location.y;
     instance()->NPP_HandleEvent(&np_event);
   }
 
 #ifndef NP_NO_QUICKDRAW
   // Quickdraw-based plugins can draw at any time, so tell the renderer to
   // repaint.
   // TODO: only do this if the contents of the offscreen window has changed,
   // so as not to spam the renderer with an unchanging image.
-  if (instance()->drawing_model() == NPDrawingModelQuickDraw)
+  if (instance() && instance()->drawing_model() == NPDrawingModelQuickDraw)
     instance()->webplugin()->Invalidate();
 #endif
 }
 #endif  // !NP_NO_CARBON