Don't access WebPluginInfo array out of bounds in PluginGroup::RemovePlugin.

webkit/plugins/npapi/plugin_group.cc

Index: webkit/plugins/npapi/plugin_group.cc
diff --git a/webkit/plugins/npapi/plugin_group.cc b/webkit/plugins/npapi/plugin_group.cc
index dd2bb1fc7bd9a00f0585e2afac20c156ea704d66..ef6b71814b20d1b357b67abab65b5bab83ddf645 100644
--- a/webkit/plugins/npapi/plugin_group.cc
+++ b/webkit/plugins/npapi/plugin_group.cc
@@ -248,10 +248,11 @@ bool PluginGroup::RemovePlugin(const FilePath& filename) {
   ResetGroupState();
   for (size_t i = 0; i < web_plugin_infos_.size(); ++i) {
     if (web_plugin_infos_[i].path == filename) {
-      web_plugin_infos_.erase(web_plugin_infos_.begin() + i);
+      web_plugin_infos_.erase(web_plugin_infos_.begin() + i--);

[jam, 2011/02/23 19:49:59]

nit: usually i've seen this be done by not having ++i in the for loop, and
incrementing "i" only in the else statement.  i think that's a little easier to
read, and avoids having the size_t value wrap around

       did_remove = true;
+    } else {
+      UpdateActivePlugin(web_plugin_infos_[i]);
     }
-    UpdateActivePlugin(web_plugin_infos_[i]);
   }
   return did_remove;
 }