Fix a crash related to PPAPI scripting.

webkit/plugins/ppapi/message_channel.h

-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef WEBKIT_PLUGINS_PPAPI_MESSAGE_CHANNEL_H_
 #define WEBKIT_PLUGINS_PPAPI_MESSAGE_CHANNEL_H_
 
 #include "base/memory/weak_ptr.h"
 #include "ppapi/shared_impl/resource.h"
 #include "third_party/npapi/bindings/npruntime.h"
 
@@ skipping 23 matching lines @@
 class MessageChannel {
  public:
   // MessageChannelNPObject is a simple struct that adds a pointer back to a
   // MessageChannel instance.  This way, we can use an NPObject to allow
   // JavaScript interactions without forcing MessageChannel to inherit from
   // NPObject.
   struct MessageChannelNPObject : public NPObject {
     MessageChannelNPObject();
     ~MessageChannelNPObject();
 
-    MessageChannel* message_channel;
+    base::WeakPtr<MessageChannel> message_channel;
   };
 
   explicit MessageChannel(PluginInstance* instance);
   ~MessageChannel();
 
   // Post a message to the onmessage handler for this channel's instance
   // asynchronously.
   void PostMessageToJavaScript(PP_Var message_data);
   // Post a message to the PPP_Instance HandleMessage function for this
   // channel's instance.
@@ skipping 39 matching lines @@
   // destroyed.
   base::WeakPtrFactory<MessageChannel> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(MessageChannel);
 };
 
 }  // namespace ppapi
 }  // namespace webkit
 
 #endif  // WEBKIT_PLUGINS_PPAPI_MESSAGE_CHANNEL_H_