Fix WebViewPlugin::scheduleAnimation crash

content/renderer/pepper/pepper_webplugin_impl.cc

Index: content/renderer/pepper/pepper_webplugin_impl.cc
diff --git a/content/renderer/pepper/pepper_webplugin_impl.cc b/content/renderer/pepper/pepper_webplugin_impl.cc
index 0caa190b0461432f89bd11635f5dde6646099123..a7b8cec01ea6401d8d05e2f0253c6392607f18e0 100644
--- a/content/renderer/pepper/pepper_webplugin_impl.cc
+++ b/content/renderer/pepper/pepper_webplugin_impl.cc
@@ -124,6 +124,7 @@ void PepperWebPluginImpl::destroy() {
   // Tell |container_| to clear references to this plugin's script objects.
   if (container_)
     container_->clearScriptObjects();
+  container_ = nullptr;

[raymes, 2015/05/12 00:36:30]

I'm not sure that this will actually have any impact on anything but it
shouldn't hurt either. In some cases I believe the container is used during
destruction of the plugin but not in this class it seems.

[trchen, 2015/05/12 01:35:33]

Yes I think you're right. Accessing a destroyed plugin is technically
use-after-free anyway. I cleared it just in case because the pre-roller most
likely got its dangling pointer from here.

 
   if (instance_.get()) {
     ppapi::PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(instance_object_);
@@ -131,6 +132,7 @@ void PepperWebPluginImpl::destroy() {
     instance_->Delete();
     instance_ = NULL;
   }
+  throttler_.reset();
 
   base::MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }