Make sure the plugin scriptable object is released before NPP_Destroy.

content/common/npobject_stub.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // A class that receives IPC messages from an NPObjectProxy and calls the real
 // NPObject.
 
 #ifndef CONTENT_COMMON_NPOBJECT_STUB_H_
 #define CONTENT_COMMON_NPOBJECT_STUB_H_
 #pragma once
@@ skipping 23 matching lines @@
   NPObjectStub(NPObject* npobject,
                NPChannelBase* channel,
                int route_id,
                gfx::NativeViewId containing_window,
                const GURL& page_url);
   virtual ~NPObjectStub();
 
   // Schedules tear-down of this stub.  The underlying NPObject reference is
   // released, and further invokations form the IPC channel will fail once this
   // call has returned.  Deletion of the stub is deferred to the main loop, in
-  // case it is touched as the stack unwinds.
+  // case it is touched as the stack unwinds.  DeleteSoon() is safe to call
+  // more than once, until control returns to the main loop.
   void DeleteSoon();
 
   // IPC::Message::Sender implementation:
   virtual bool Send(IPC::Message* msg) OVERRIDE;
 
   // NPObjectBase implementation.
   virtual NPObject* GetUnderlyingNPObject() OVERRIDE;
   virtual IPC::Channel::Listener* GetChannelListener() OVERRIDE;
 
  private:
@@ skipping 31 matching lines @@
   NPObject* npobject_;
   scoped_refptr<NPChannelBase> channel_;
   int route_id_;
   gfx::NativeViewId containing_window_;
 
   // The url of the main frame hosting the plugin.
   GURL page_url_;
 };
 
 #endif  // CONTENT_COMMON_NPOBJECT_STUB_H_