Fix WebViewPlugin::scheduleAnimation crash

content/renderer/pepper/pepper_webplugin_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_webplugin_impl.h"
 
 #include <cmath>
 
 #include "base/debug/crash_logging.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 106 matching lines @@
 
   init_data_.reset();
   container_ = container;
   return true;
 }
 
 void PepperWebPluginImpl::destroy() {
   // Tell |container_| to clear references to this plugin's script objects.
   if (container_)
     container_->clearScriptObjects();
+  container_ = nullptr;

[raymes, 2015/05/12 00:36:30]

I'm not sure that this will actually have any impact on anything but it
shouldn't hurt either. In some cases I believe the container is used during
destruction of the plugin but not in this class it seems.

[trchen, 2015/05/12 01:35:33]

Yes I think you're right. Accessing a destroyed plugin is technically
use-after-free anyway. I cleared it just in case because the pre-roller most
likely got its dangling pointer from here.

 
   if (instance_.get()) {
     ppapi::PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(instance_object_);
     instance_object_ = PP_MakeUndefined();
     instance_->Delete();
     instance_ = NULL;
   }
+  throttler_.reset();
 
   base::MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 v8::Local<v8::Object> PepperWebPluginImpl::v8ScriptableObject(
       v8::Isolate* isolate) {
   // Call through the plugin to get its instance object. The plugin should pass
   // us a reference which we release in destroy().
   if (instance_object_.type == PP_VARTYPE_UNDEFINED)
     instance_object_ = instance_->GetInstanceObject(isolate);
@@ skipping 144 matching lines @@
 
 bool PepperWebPluginImpl::canRotateView() { return instance_->CanRotateView(); }
 
 void PepperWebPluginImpl::rotateView(RotationType type) {
   instance_->RotateView(type);
 }
 
 bool PepperWebPluginImpl::isPlaceholder() { return false; }
 
 }  // namespace content