Make sure the plugin scriptable object is released before NPP_Destroy.

content/plugin/webplugin_delegate_stub.cc

Index: content/plugin/webplugin_delegate_stub.cc
diff --git a/content/plugin/webplugin_delegate_stub.cc b/content/plugin/webplugin_delegate_stub.cc
index bc130b2a0e3e91b039958b4061f25fbf67d90a48..5ef5743101361ee667f5c45be66b430eba2f7c0b 100644
--- a/content/plugin/webplugin_delegate_stub.cc
+++ b/content/plugin/webplugin_delegate_stub.cc
@@ -9,7 +9,6 @@
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/string_number_conversions.h"
-#include "content/common/npobject_stub.h"
 #include "content/common/plugin_messages.h"
 #include "content/plugin/plugin_channel.h"
 #include "content/plugin/plugin_thread.h"
@@ -31,7 +30,13 @@ using webkit::npapi::WebPlugin;
 using webkit::npapi::WebPluginResourceClient;
 
 static void DestroyWebPluginAndDelegate(
-    webkit::npapi::WebPluginDelegateImpl* delegate, WebPlugin* webplugin) {
+    base::WeakPtr<NPObjectStub> scriptable_object,
+    webkit::npapi::WebPluginDelegateImpl* delegate,
+    WebPlugin* webplugin) {
+  // The plugin may not expect us to try to release the scriptable object
+  // after calling NPP_Destroy on the instance, so delete the stub now.
+  if (scriptable_object.get())
+    scriptable_object->DeleteSoon();
   // WebPlugin must outlive WebPluginDelegate.
   if (delegate)
     delegate->PluginDestroyed();
@@ -58,7 +63,8 @@ WebPluginDelegateStub::~WebPluginDelegateStub() {
     // The delegate or an npobject is in the callstack, so don't delete it
     // right away.
     MessageLoop::current()->PostNonNestableTask(FROM_HERE,
-        base::Bind(&DestroyWebPluginAndDelegate, delegate_, webplugin_));
+        base::Bind(&DestroyWebPluginAndDelegate, plugin_scriptable_object_,
+                   delegate_, webplugin_));
   } else {
     // Safe to delete right away.
     DestroyWebPluginAndDelegate(delegate_, webplugin_);
@@ -284,9 +290,10 @@ void WebPluginDelegateStub::OnGetPluginScriptableObject(int* route_id) {
   *route_id = channel_->GenerateRouteID();
   // The stub will delete itself when the proxy tells it that it's released, or

[cpu_(ooo_6.6-7.5), 2012/03/22 00:09:28]

stale comment line 291

[Wez, 2012/03/22 00:42:20]

Done.

   // otherwise when the channel is closed.
-  new NPObjectStub(
+  NPObjectStub* scriptable_stub = new NPObjectStub(
       object, channel_.get(), *route_id, webplugin_->containing_window(),
       page_url_);
+  plugin_scriptable_object_ = scriptable_stub->AsWeakPtr();
 
   // Release ref added by GetPluginScriptableObject (our stub holds its own).
   WebBindings::releaseObject(object);