Fix a crash in the NPAPI plugin code which occurs after we call the plugins window proc.

content/child/npapi/webplugin_delegate_impl_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/npapi/webplugin_delegate_impl.h"
 
 #include <map>
 #include <set>
 #include <string>
 #include <vector>
@@ skipping 1004 matching lines @@
 
     // Maintain a local/global stack for the g_current_plugin_instance variable
     // as this may be a nested invocation.
     WebPluginDelegateImpl* last_plugin_instance = g_current_plugin_instance;
 
     g_current_plugin_instance = delegate;
 
     result = CallWindowProc(
         delegate->plugin_wnd_proc_, hwnd, message, wparam, lparam);
 
-    delegate->is_calling_wndproc = false;
+    // The plugin instance may have been destroyed in the CallWindowProc call
+    // above. This will also destroy the plugin window. Before attempting to
+    // access the WebPluginDelegateImpl instance we validate if the window is
+    // still valid.
+    if (::IsWindow(hwnd))
+      delegate->is_calling_wndproc = false;
+
     g_current_plugin_instance = last_plugin_instance;
 
     if (message == WM_NCDESTROY) {
       RemoveProp(hwnd, kWebPluginDelegateProperty);
       ATOM plugin_name_atom = reinterpret_cast<ATOM>(
           RemoveProp(hwnd, kPluginNameAtomProperty));
       if (plugin_name_atom != 0)
         GlobalDeleteAtom(plugin_name_atom);
       ATOM plugin_version_atom = reinterpret_cast<ATOM>(
           RemoveProp(hwnd, kPluginVersionAtomProperty));
       if (plugin_version_atom != 0)
         GlobalDeleteAtom(plugin_version_atom);
       ClearThrottleQueueForWindow(hwnd);
     }
   }
-  delegate->last_message_ = old_message;
+  if (::IsWindow(hwnd))
+    delegate->last_message_ = old_message;
   return result;
 }
 
 void WebPluginDelegateImpl::WindowlessUpdateGeometry(
     const gfx::Rect& window_rect,
     const gfx::Rect& clip_rect) {
   bool window_rect_changed = (window_rect_ != window_rect);
   // Only resend to the instance if the geometry has changed.
   if (!window_rect_changed && clip_rect == clip_rect_)
     return;
@@ skipping 471 matching lines @@
     case WM_RBUTTONUP:
       ::ReleaseCapture();
       break;
 
     default:
       break;
   }
 }
 
 }  // namespace content