Make sure the plugin scriptable object is released before NPP_Destroy.

content/plugin/webplugin_delegate_stub.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/plugin/webplugin_delegate_stub.h"
 
 #include "build/build_config.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/string_number_conversions.h"
-#include "content/common/npobject_stub.h"
 #include "content/common/plugin_messages.h"
 #include "content/plugin/plugin_channel.h"
 #include "content/plugin/plugin_thread.h"
 #include "content/plugin/webplugin_proxy.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_switches.h"
 #include "third_party/npapi/bindings/npapi.h"
 #include "third_party/npapi/bindings/npruntime.h"
 #include "skia/ext/platform_device.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebBindings.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebCursorInfo.h"
 #include "webkit/plugins/npapi/webplugin_delegate_impl.h"
 #include "webkit/glue/webcursor.h"
 
 using WebKit::WebBindings;
 using WebKit::WebCursorInfo;
 using webkit::npapi::WebPlugin;
 using webkit::npapi::WebPluginResourceClient;
 
 static void DestroyWebPluginAndDelegate(
-    webkit::npapi::WebPluginDelegateImpl* delegate, WebPlugin* webplugin) {
+    base::WeakPtr<NPObjectStub> scriptable_object,
+    webkit::npapi::WebPluginDelegateImpl* delegate,
+    WebPlugin* webplugin) {
+  // The plugin may not expect us to try to release the scriptable object
+  // after calling NPP_Destroy on the instance, so delete the stub now.
+  if (scriptable_object.get())
+    scriptable_object->DeleteSoon();
   // WebPlugin must outlive WebPluginDelegate.
   if (delegate)
     delegate->PluginDestroyed();
 
   delete webplugin;
 }
 
 WebPluginDelegateStub::WebPluginDelegateStub(
     const std::string& mime_type, int instance_id, PluginChannel* channel) :
     mime_type_(mime_type),
     instance_id_(instance_id),
     channel_(channel),
     delegate_(NULL),
     webplugin_(NULL),
     in_destructor_(false) {
   DCHECK(channel);
 }
 
 WebPluginDelegateStub::~WebPluginDelegateStub() {
   in_destructor_ = true;
   content::GetContentClient()->SetActiveURL(page_url_);
 
   if (channel_->in_send()) {
     // The delegate or an npobject is in the callstack, so don't delete it
     // right away.
     MessageLoop::current()->PostNonNestableTask(FROM_HERE,
-        base::Bind(&DestroyWebPluginAndDelegate, delegate_, webplugin_));
+        base::Bind(&DestroyWebPluginAndDelegate, plugin_scriptable_object_,
+                   delegate_, webplugin_));
   } else {
     // Safe to delete right away.
-    DestroyWebPluginAndDelegate(delegate_, webplugin_);
+    DestroyWebPluginAndDelegate(
+        plugin_scriptable_object_, delegate_, webplugin_);
   }
 }
 
 bool WebPluginDelegateStub::OnMessageReceived(const IPC::Message& msg) {
   content::GetContentClient()->SetActiveURL(page_url_);
 
   // A plugin can execute a script to delete itself in any of its NPP methods.
   // Hold an extra reference to ourself so that if this does occur and we're
   // handling a sync message, we don't crash when attempting to send a reply.
   // The exception to this is when we're already in the destructor.
@@ skipping 200 matching lines @@
 }
 
 void WebPluginDelegateStub::OnGetPluginScriptableObject(int* route_id) {
   NPObject* object = delegate_->GetPluginScriptableObject();
   if (!object) {
     *route_id = MSG_ROUTING_NONE;
     return;
   }
 
   *route_id = channel_->GenerateRouteID();
-  // The stub will delete itself when the proxy tells it that it's released, or
-  // otherwise when the channel is closed.
-  new NPObjectStub(
+  // We will delete the stub immediately before calling PluginDestroyed on the
+  // delegate. It will delete itself sooner if the proxy tells it that it has
+  // been released, or if the channel to the proxy is closed.
+  NPObjectStub* scriptable_stub = new NPObjectStub(
       object, channel_.get(), *route_id, webplugin_->containing_window(),
       page_url_);
+  plugin_scriptable_object_ = scriptable_stub->AsWeakPtr();
 
   // Release ref added by GetPluginScriptableObject (our stub holds its own).
   WebBindings::releaseObject(object);
 }
 
 void WebPluginDelegateStub::OnGetFormValue(string16* value, bool* success) {
   *success = false;
   if (!delegate_)
     return;
   *success = delegate_->GetFormValue(value);
@@ skipping 98 matching lines @@
       delegate_->CreateSeekableResourceClient(resource_id, range_request_id);
   webplugin_->OnResourceCreated(resource_id, resource_client);
 }
 
 #if defined(OS_MACOSX)
 void WebPluginDelegateStub::OnSetFakeAcceleratedSurfaceWindowHandle(
     gfx::PluginWindowHandle window) {
   delegate_->set_windowed_handle(window);
 }
 #endif