Re-land http://codereview.chromium.org/9403039/, r124106

webkit/plugins/ppapi/ppapi_plugin_instance.cc

Index: webkit/plugins/ppapi/ppapi_plugin_instance.cc
diff --git a/webkit/plugins/ppapi/ppapi_plugin_instance.cc b/webkit/plugins/ppapi/ppapi_plugin_instance.cc
index e4c13c4f6b278dceb3e862369c6c136050f02612..3135a3c282f4dca03a6b2b1177e7e0cdf0519f18 100644
--- a/webkit/plugins/ppapi/ppapi_plugin_instance.cc
+++ b/webkit/plugins/ppapi/ppapi_plugin_instance.cc
@@ -358,6 +358,11 @@ PluginInstance::~PluginInstance() {
 void PluginInstance::Delete() {
   // Keep a reference on the stack. See NOTE above.
   scoped_refptr<PluginInstance> ref(this);
+  // Force the MessageChannel to release its "passthrough object" which should
+  // release our last reference to the "InstanceObject" and will probably
+  // destroy it. We want to do this prior to calling DidDestroy in case the
+  // destructor of the instance object tries to use the instance.
+  message_channel_->SetPassthroughObject(NULL);
   instance_interface_->DidDestroy(pp_instance());
 
   if (fullscreen_container_) {