linux/mac: Fix race condition when destroying the renderer<->plugin channel

chrome/renderer/webplugin_delegate_proxy.cc

Index: chrome/renderer/webplugin_delegate_proxy.cc
diff --git a/chrome/renderer/webplugin_delegate_proxy.cc b/chrome/renderer/webplugin_delegate_proxy.cc
index e36126d0b6afbe356527d1dbc0e286d1815f01c7..b109df0b1985dd3b45a72650b79363b64db83d97 100644
--- a/chrome/renderer/webplugin_delegate_proxy.cc
+++ b/chrome/renderer/webplugin_delegate_proxy.cc
@@ -208,6 +208,14 @@ void WebPluginDelegateProxy::PluginDestroyed() {
   if (channel_host_) {
     channel_host_->RemoveRoute(instance_id_);
     Send(new PluginMsg_DestroyInstance(instance_id_));
+    // Release the channel host now. If we are is the last reference to the
+    // channel, this avoids a race where this renderer asks a new connection to
+    // the same plugin between now and the time 'this' is actually deleted.
+    // Destroying the channel host is what releases the channel name -> FD
+    // association on POSIX, and if we ask for a new connection before it is
+    // released, the plugin will give us a new FD, and we'll assert when trying
+    // to associate it with the channel name.
+    channel_host_ = NULL;

[jam, 2009/08/11 01:37:47]

What about other WebPluginDelegateProxy methods that assume channel_host_ is
non-null and can be called in the meantime (i.e. Paint)?  Don't these functions
need to be updated in this change?

   }
 
   render_view_->PluginDestroyed(this);