Keep the module in scope when executing scripts. This prevents a crash when the

ppapi/proxy/ppb_instance_proxy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/ppb_instance_proxy.h"
 
 #include "ppapi/c/pp_var.h"
 #include "ppapi/c/ppb_instance.h"
 #include "ppapi/proxy/host_dispatcher.h"
 #include "ppapi/proxy/plugin_dispatcher.h"
@@ skipping 102 matching lines @@
     &instance_interface,
     PPB_INSTANCE_INTERFACE,
     INTERFACE_ID_PPB_INSTANCE,
     false,
     &CreateInstanceProxy,
   };
   return &info;
 }
 
 bool PPB_Instance_Proxy::OnMessageReceived(const IPC::Message& msg) {
+  // Prevent the dispatcher from going away during a call to ExecuteScript.
+  // This must happen OUTSIDE of ExecuteScript since the SerializedVars use
+  // the dispatcher upon return of the function (converting the
+  // SerializedVarReturnValue/OutParam to a SerializedVar in the destructor).
+  ScopedModuleReference death_grip(dispatcher());
+
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(PPB_Instance_Proxy, msg)
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBInstance_GetWindowObject,
                         OnMsgGetWindowObject)
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBInstance_GetOwnerElementObject,
                         OnMsgGetOwnerElementObject)
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBInstance_BindGraphics,
                         OnMsgBindGraphics)
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBInstance_IsFullFrame,
                         OnMsgIsFullFrame)
@@ skipping 41 matching lines @@
     static_cast<HostDispatcher*>(dispatcher())->set_allow_plugin_reentrancy();
 
   result.Return(dispatcher(), ppb_instance_target()->ExecuteScript(
       instance,
       script.Get(dispatcher()),
       out_exception.OutParam(dispatcher())));
 }
 
 }  // namespace proxy
 }  // namespace pp