Index: content/renderer/pepper/pepper_plugin_instance_impl.cc |
diff --git a/content/renderer/pepper/pepper_plugin_instance_impl.cc b/content/renderer/pepper/pepper_plugin_instance_impl.cc |
index cbd809571cc44a960d421552e0cff978a63c3ee1..576f7a00246f92e9ed385814a53e96623e864f6c 100644 |
--- a/content/renderer/pepper/pepper_plugin_instance_impl.cc |
+++ b/content/renderer/pepper/pepper_plugin_instance_impl.cc |
@@ -670,6 +670,13 @@ void PepperPluginInstanceImpl::Delete() { |
// Keep a reference on the stack. See NOTE above. |
scoped_refptr<PepperPluginInstanceImpl> ref(this); |
+ |
+ // It is important to destroy the throttler before anything else. |
+ // The plugin instance may flush its graphics pipeline during its postmortem |
+ // spasm, causing the throttler to engage and obtain new dangling reference |
+ // to the plugin container being destroyed. |
+ throttler_.reset(); |
+ |
// Force the MessageChannel to release its "passthrough object" which should |
// release our last reference to the "InstanceObject" and will probably |
// destroy it. We want to do this prior to calling DidDestroy in case the |