Fix a crash in the renderer process which occurs in the PPAPI host code due to the underlying plugin

webkit/plugins/ppapi/plugin_object.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/plugin_object.h"
 
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/string_number_conversions.h"
@@ skipping 59 matching lines @@
                          NPVariant* result) {
   NPObjectAccessorWithIdentifier accessor(object, method_name, false);
   if (!accessor.is_valid())
     return false;
 
   PPResultAndExceptionToNPResult result_converter(
       accessor.object()->GetNPObject(), result);
   PPVarArrayFromNPVariantArray args(accessor.object()->instance(),
                                     argc, argv);
 
+  // For the OOP plugin case we need to grab a reference on the plugin module
+  // object to ensure that it is not destroyed courtsey an incoming
+  // ExecuteScript call which destroys the plugin module and in turn the
+  // dispatcher.
+  scoped_refptr<webkit::ppapi::PluginModule> ref(
+      accessor.object()->instance()->module());
+
   return result_converter.SetResult(accessor.object()->ppp_class()->Call(
       accessor.object()->ppp_class_data(), accessor.identifier(),
       argc, args.array(), result_converter.exception()));
 }
 
 bool WrapperClass_InvokeDefault(NPObject* np_object, const NPVariant* argv,
                                 uint32_t argc, NPVariant* result) {
   PluginObject* obj = PluginObject::FromNPObject(np_object);
   if (!obj)
     return false;
 
   PPVarArrayFromNPVariantArray args(obj->instance(), argc, argv);
   PPResultAndExceptionToNPResult result_converter(obj->GetNPObject(), result);
 
+  // For the OOP plugin case we need to grab a reference on the plugin module
+  // object to ensure that it is not destroyed courtsey an incoming
+  // ExecuteScript call which destroys the plugin module and in turn the
+  // dispatcher.
+  scoped_refptr<webkit::ppapi::PluginModule> ref(
+      obj->instance()->module());
+
   result_converter.SetResult(obj->ppp_class()->Call(
       obj->ppp_class_data(), PP_MakeUndefined(), argc, args.array(),
       result_converter.exception()));
   return result_converter.success();
 }
 
 bool WrapperClass_HasProperty(NPObject* object, NPIdentifier property_name) {
   NPObjectAccessorWithIdentifier accessor(object, property_name, true);
   if (!accessor.is_valid())
     return false;
@@ skipping 230 matching lines @@
 // static
 NPObject* PluginObject::AllocateObjectWrapper() {
   NPObjectWrapper* wrapper = new NPObjectWrapper;
   memset(wrapper, 0, sizeof(NPObjectWrapper));
   return wrapper;
 }
 
 }  // namespace ppapi
 }  // namespace webkit