Add a NULL channel check in CreateNPVariantParam as it can be called with...

chrome/plugin/npobject_util.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/plugin/npobject_util.h"
 
 #include "chrome/common/plugin_messages.h"
 #include "chrome/common/win_util.h"
 #include "chrome/plugin/npobject_proxy.h"
 #include "chrome/plugin/plugin_channel_base.h"
@@ skipping 153 matching lines @@
       break;
     case NPVariantType_Object:
     {
       if (variant.value.objectValue->_class == NPObjectProxy::npclass()) {
         param->type = NPVARIANT_PARAM_OBJECT_POINTER;
         param->npobject_pointer =
             NPObjectProxy::GetProxy(variant.value.objectValue)->npobject_ptr();
         // Don't release, because our original variant is the same as our proxy.
         release = false;
       } else {
-        // NPObjectStub adds its own reference to the NPObject it owns, so if we
-        // were supposed to release the corresponding variant (release==true),
-        // we should still do that.
-        param->type = NPVARIANT_PARAM_OBJECT_ROUTING_ID;
-        int route_id = channel->GenerateRouteID();
-        NPObjectStub* object_stub = new NPObjectStub(
-            variant.value.objectValue, channel, route_id);
-        param->npobject_routing_id = route_id;
-        param->npobject_pointer = variant.value.objectValue;
+        // The channel could be NULL if there was a channel error. The caller's
+        // Send call will fail anyways.
+        if (channel) {
+          // NPObjectStub adds its own reference to the NPObject it owns, so if
+          // we were supposed to release the corresponding variant
+          // (release==true), we should still do that.
+          param->type = NPVARIANT_PARAM_OBJECT_ROUTING_ID;
+          int route_id = channel->GenerateRouteID();
+          NPObjectStub* object_stub = new NPObjectStub(
+              variant.value.objectValue, channel, route_id);
+          param->npobject_routing_id = route_id;
+          param->npobject_pointer = variant.value.objectValue;
+        } else {
+          param->type = NPVARIANT_PARAM_VOID;
+        }
       }
       break;
     }
     default:
       NOTREACHED();
   }
 
   if (release)
     NPN_ReleaseVariantValue(const_cast<NPVariant*>(&variant));
 }
@@ skipping 38 matching lines @@
     case NPVARIANT_PARAM_OBJECT_POINTER:
       result->type = NPVariantType_Object;
       result->value.objectValue = static_cast<NPObject*>(param.npobject_pointer);
       NPN_RetainObject(result->value.objectValue);
       break;
     default:
       NOTREACHED();
   }
 }