Don't access WebPluginInfo array out of bounds in PluginGroup::RemovePlugin.

webkit/plugins/npapi/plugin_group.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "webkit/plugins/npapi/plugin_group.h"
 
 #include "base/linked_ptr.h"
 #include "base/string_util.h"
@@ skipping 230 matching lines @@
   }
   web_plugin_infos_.push_back(plugin);
   UpdateActivePlugin(web_plugin_infos_.back());
 }
 
 bool PluginGroup::RemovePlugin(const FilePath& filename) {
   bool did_remove = false;
   ResetGroupState();
   for (size_t i = 0; i < web_plugin_infos_.size(); ++i) {
     if (web_plugin_infos_[i].path == filename) {
-      web_plugin_infos_.erase(web_plugin_infos_.begin() + i);
+      web_plugin_infos_.erase(web_plugin_infos_.begin() + i--);

[jam, 2011/02/23 19:49:59]

nit: usually i've seen this be done by not having ++i in the for loop, and
incrementing "i" only in the else statement.  i think that's a little easier to
read, and avoids having the size_t value wrap around

       did_remove = true;
+    } else {
+      UpdateActivePlugin(web_plugin_infos_[i]);
     }
-    UpdateActivePlugin(web_plugin_infos_[i]);
   }
   return did_remove;
 }
 
 bool PluginGroup::EnablePlugin(const FilePath& filename) {
   bool did_enable = false;
   ResetGroupState();
   for (size_t i = 0; i < web_plugin_infos_.size(); ++i) {
     if (web_plugin_infos_[i].path == filename)
       did_enable = Enable(&web_plugin_infos_[i], WebPluginInfo::USER_ENABLED);
@@ skipping 256 matching lines @@
     // Only changeable if not managed.
     if (plugin->enabled & WebPluginInfo::MANAGED_MASK)
       return false;
     plugin->enabled = new_reason;
   }
   return true;
 }
 
 }  // namespace npapi
 }  // namespace webkit