PPAPI: Really force-free NPObjects on Instance destruction.

webkit/plugins/ppapi/ppapi_plugin_instance.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppapi_plugin_instance.h"
 
 #include "base/bind.h"
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
 #include "base/memory/linked_ptr.h"
@@ skipping 335 matching lines @@
 
 // NOTE: Any of these methods that calls into the plugin needs to take into
 // account that the plugin may use Var to remove the <embed> from the DOM, which
 // will make the WebPluginImpl drop its reference, usually the last one. If a
 // method needs to access a member of the instance after the call has returned,
 // then it needs to keep its own reference on the stack.
 
 void PluginInstance::Delete() {
   // Keep a reference on the stack. See NOTE above.
   scoped_refptr<PluginInstance> ref(this);
+  // Force the MessageChannel to release its "passthrough object" which should
+  // release our last reference to the "InstanceObject" and will probably
+  // destroy it. We want to do this prior to calling DidDestroy in case the
+  // destructor of the instance object tries to use the instance.
+  message_channel_->SetPassthroughObject(NULL);
   instance_interface_->DidDestroy(pp_instance());
 
   if (fullscreen_container_) {
     fullscreen_container_->Destroy();
     fullscreen_container_ = NULL;
   }
   container_ = NULL;
 }
 
 void PluginInstance::Paint(WebCanvas* canvas,
@@ skipping 1753 matching lines @@
   screen_size_for_fullscreen_ = gfx::Size();
   WebElement element = container_->element();
   element.setAttribute(WebString::fromUTF8(kWidth), width_before_fullscreen_);
   element.setAttribute(WebString::fromUTF8(kHeight), height_before_fullscreen_);
   element.setAttribute(WebString::fromUTF8(kBorder), border_before_fullscreen_);
   element.setAttribute(WebString::fromUTF8(kStyle), style_before_fullscreen_);
 }
 
 }  // namespace ppapi
 }  // namespace webkit