NULL nobject_ in the stub prior to deallocating the object, to avoid re-entrancy into NPObjectStu...

NULL nobject_ in the stub prior to deallocating the object, to avoid re-entrancy into NPObjectStub::DeleteSoon() during NPObjectStub::OnChannelError() from double-deleting the stub.

BUG=94179
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=98746

[eroman, 2011-08-29 19:44:20]

Darin, this is a follow-up to the instrumentation change I sent you last week.
It yielded callstacks revealing how the double free was happening, see
http://code.google.com/p/chromium/issues/detail?id=94179#c17 for the details.

Note: I am not familiar with this code so please check carefully that this makes
sense and I am not papering over some other wrong interaction.

Since the existing code was already checking for a NULL-ed object and similarly
nulling it as part of DeleteSoon, I believe my change to be in the same spirit,
and simply moving the assignment one-line earlier to catch stuff that could
happen from releaseObject.

Lastly I apologize this fix contains no unit-test. I tried writing one but
lacked the expertize so am postponing. I am hoping to pass that work off once
the in-field crashes are proven fixed.

[Wez, 2011-08-29 19:46:39]

This LGTM.

[darin (slow to review), 2011-08-29 19:52:15]

LGTM

Can you construct a regression test?

[eroman, 2011-08-29 21:48:10]

> Can you construct a regression test?

Absolutely. James has agree to help me with a test, hopefully we can come up
with something soon.

[commit-bot: I haz the power, 2011-08-30 01:15:16]

Change committed as 98746

[eroman, 2011-08-30 19:27:38]

FYI: Wez has written a unit-test for this codepath:
http://codereview.chromium.org/7806020

(so your comment about adding regression test should now be addressed).