Fix WebViewPlugin::scheduleAnimation crash

content/renderer/pepper/pepper_webplugin_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_webplugin_impl.h"
 
 #include <cmath>
 
 #include "base/debug/crash_logging.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 106 matching lines @@
 
   init_data_.reset();
   container_ = container;
   return true;
 }
 
 void PepperWebPluginImpl::destroy() {
   // Tell |container_| to clear references to this plugin's script objects.
   if (container_)
     container_->clearScriptObjects();
+  container_ = nullptr;
 
   if (instance_.get()) {
     ppapi::PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(instance_object_);
     instance_object_ = PP_MakeUndefined();
     instance_->Delete();
     instance_ = NULL;
   }
+  throttler_.reset();

[tommycli, 2015/05/11 21:57:23]

If the plugin has been initialized, the throttler_ variable here should be NULL.
This is because the throttler ownership is passed to the instance in 103.

However, your diagnosis might still make sense. It might be correct to clear
instance_->throttler_ in PepperPluginInstanceImpl::Delete().

That would probably fix your proposed "bad" sequence of events in the bug.

[trchen, 2015/05/11 22:09:09]

Done.

 
   base::MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 v8::Local<v8::Object> PepperWebPluginImpl::v8ScriptableObject(
       v8::Isolate* isolate) {
   // Call through the plugin to get its instance object. The plugin should pass
   // us a reference which we release in destroy().
   if (instance_object_.type == PP_VARTYPE_UNDEFINED)
     instance_object_ = instance_->GetInstanceObject(isolate);
@@ skipping 144 matching lines @@
 
 bool PepperWebPluginImpl::canRotateView() { return instance_->CanRotateView(); }
 
 void PepperWebPluginImpl::rotateView(RotationType type) {
   instance_->RotateView(type);
 }
 
 bool PepperWebPluginImpl::isPlaceholder() { return false; }
 
 }  // namespace content