NULL nobject_ in the stub prior to deallocating the object, to avoid re-entrancy into NPObjectStu...

content/plugin/npobject_stub.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/plugin/npobject_stub.h"
 
 #include "content/common/content_client.h"
 #include "content/common/plugin_messages.h"
 #include "content/plugin/npobject_util.h"
 #include "content/plugin/plugin_channel_base.h"
@@ skipping 98 matching lines @@
   base::debug::Alias(&liveness_token);
 
   CHECK_EQ(liveness_token, kTokenAlive);
 }
 
 void NPObjectStub::DeleteSoon(bool release_npobject) {
   CheckIsAlive();
 
   if (npobject_) {
     channel_->RemoveMappingForNPObjectStub(route_id_, npobject_);
+
+    // We need to NULL npobject_ prior to calling releaseObject() to avoid
+    // problems with re-entrancy. See http://crbug.com/94179#c17 for more
+    // details on how this can happen.
+    NPObject* npobject = npobject_;
+    npobject_ = NULL;
+
     if (release_npobject)
-      WebBindings::releaseObject(npobject_);
-    npobject_ = NULL;
+      WebBindings::releaseObject(npobject);
+
     MessageLoop::current()->PostTask(
       FROM_HERE,
       NewRunnableFunction(
           &NPObjectStub::DeleteSoonHelper,
           base::debug::StackTrace(),
           this));
   }
 }
 
 bool NPObjectStub::Send(IPC::Message* msg) {
@@ skipping 332 matching lines @@
       result_var, channel_, &result_param, true, containing_window_, page_url_);
   NPObjectMsg_Evaluate::WriteReplyParams(reply_msg, result_param, return_value);
   channel_->Send(reply_msg);
 }
 
 // Restore compiler optimizations and warnings.
 #if defined(COMPILER_MSVC)
 MSVC_POP_WARNING()
 #pragma optimize("", on)
 #endif