Support reviving a disposed plugin container.

third_party/WebKit/Source/web/WebPluginContainerImpl.cpp

Index: third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
diff --git a/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp b/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
index 1a9ca1339518c78fb8dc3857623631ac64e0a435..3167727860d70be4b700cda6dc752157108e6ffe 100644
--- a/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
+++ b/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
@@ -267,11 +267,12 @@ void WebPluginContainerImpl::setParent(Widget* widget)
 
 void WebPluginContainerImpl::setPlugin(WebPlugin* plugin)
 {
-    RELEASE_ASSERT(!m_inDispose);
-    if (plugin != m_webPlugin) {
-        m_element->resetInstance();
-        m_webPlugin = plugin;
-    }
+    if (plugin == m_webPlugin)
+        return;
+
+    m_element->resetInstance();
+    m_webPlugin = plugin;
+    m_isDisposed = false;
 }
 
 float WebPluginContainerImpl::deviceScaleFactor()
@@ -508,7 +509,7 @@ bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
     // be valid memory once this object has started disposal. In particular, we might be being
     // disposed because the frame has already be deleted and then something else dropped the
     // last reference to the this object.
-    if (m_inDispose || !m_element)
+    if (m_isDisposed || !m_element)
         return false;
 
     LocalFrame* frame = m_element->document().frame();
@@ -530,7 +531,7 @@ bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
 
 void WebPluginContainerImpl::requestTouchEventType(TouchEventRequestType requestType)
 {
-    if (m_touchEventRequestType == requestType)
+    if (m_touchEventRequestType == requestType || !m_element)
         return;
 
     if (m_element->document().frameHost()) {
@@ -683,7 +684,7 @@ WebPluginContainerImpl::WebPluginContainerImpl(HTMLPlugInElement* element, WebPl
     , m_webLayer(nullptr)
     , m_touchEventRequestType(TouchEventRequestTypeNone)
     , m_wantsWheelEvents(false)
-    , m_inDispose(false)
+    , m_isDisposed(false)
 {
 #if ENABLE(OILPAN)
     ThreadState::current()->registerPreFinalizer(this);
@@ -702,10 +703,9 @@ WebPluginContainerImpl::~WebPluginContainerImpl()
 
 void WebPluginContainerImpl::dispose()
 {
-    m_inDispose = true;
+    m_isDisposed = true;
 
-    if (m_element && m_touchEventRequestType != TouchEventRequestTypeNone && m_element->document().frameHost())
-        m_element->document().frameHost()->eventHandlerRegistry().didRemoveEventHandler(*m_element, EventHandlerRegistry::TouchEvent);
+    requestTouchEventType(TouchEventRequestTypeNone);
 
     if (m_webPlugin) {
         RELEASE_ASSERT(!m_webPlugin->container() || m_webPlugin->container() == this);
@@ -717,8 +717,6 @@ void WebPluginContainerImpl::dispose()
         GraphicsLayer::unregisterContentsLayer(m_webLayer);
         m_webLayer = nullptr;
     }
-
-    m_element = nullptr;
 }
 
 DEFINE_TRACE(WebPluginContainerImpl)