Oilpan: update plugin handling to work over plugins persisted over reattach

Source/web/WebPluginContainerImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 588 matching lines @@
     m_webPlugin->didFailLoading(error);
 }
 
 WebLayer* WebPluginContainerImpl::platformLayer() const
 {
     return m_webLayer;
 }
 
 v8::Local<v8::Object> WebPluginContainerImpl::scriptableObject(v8::Isolate* isolate)
 {
+#if ENABLE(OILPAN)
+    // With Oilpan, on plugin element detach dispose() will be called to safely
+    // clear out references, including the pre-emptive destruction of the plugin.
+    //
+    // It clearly has no scriptable object if in such a disposed state.
+    if (!m_webPlugin)
+        return v8::Local<v8::Object>();
+#endif
+
     // The plugin may be destroyed due to re-entrancy when calling
     // v8ScriptableObject below. crbug.com/458776. Hold a reference to the
     // plugin container to prevent this from happening. For Oilpan, 'this'
     // is already stack reachable, so redundant.
     RefPtrWillBeRawPtr<WebPluginContainerImpl> protector(this);
 
     v8::Local<v8::Object> object = m_webPlugin->v8ScriptableObject(isolate);
 
     // If the plugin has been destroyed and the reference on the stack is the
     // only one left, then don't return the scriptable object.
@@ skipping 332 matching lines @@
     clipRect.move(-windowRect.x(), -windowRect.y());
     unobscuredRect.move(-windowRect.x(), -windowRect.y());
 
     getPluginOcclusions(m_element, this->parent(), frameRect(), cutOutRects);
     // Convert to the plugin position.
     for (size_t i = 0; i < cutOutRects.size(); i++)
         cutOutRects[i].move(-frameRect().x(), -frameRect().y());
 }
 
 } // namespace blink