Don't access WebPluginInfo array out of bounds in PluginGroup::RemovePlugin.

webkit/plugins/npapi/plugin_group.cc

Index: webkit/plugins/npapi/plugin_group.cc
diff --git a/webkit/plugins/npapi/plugin_group.cc b/webkit/plugins/npapi/plugin_group.cc
index dd2bb1fc7bd9a00f0585e2afac20c156ea704d66..bd24f3d5b8355d1a6bf6a3f973f2c449bd3d155b 100644
--- a/webkit/plugins/npapi/plugin_group.cc
+++ b/webkit/plugins/npapi/plugin_group.cc
@@ -246,12 +246,14 @@ void PluginGroup::AddPlugin(const WebPluginInfo& plugin) {
 bool PluginGroup::RemovePlugin(const FilePath& filename) {
   bool did_remove = false;
   ResetGroupState();
-  for (size_t i = 0; i < web_plugin_infos_.size(); ++i) {
+  for (size_t i = 0; i < web_plugin_infos_.size();) {
     if (web_plugin_infos_[i].path == filename) {
       web_plugin_infos_.erase(web_plugin_infos_.begin() + i);
       did_remove = true;
+    } else {
+      UpdateActivePlugin(web_plugin_infos_[i]);
+      i++;
     }
-    UpdateActivePlugin(web_plugin_infos_[i]);
   }
   return did_remove;
 }