Fixes a crash caused due to a call to NPP_DestroyStream occuring in the conte...

webkit/glue/webplugin_impl.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "FormState.h"
 #include "Frame.h"
@@ skipping 751 matching lines @@
   // error codes in the stream header and as a result, was unaware of the
   // fate of the HTTP requests issued via NPN_GetURLNotify. Webkit and FF
   // destroy the stream and invoke the NPP_DestroyStream function on the
   // plugin if the HTTP request fails.
   const GURL& url = response.url();
   if (url.SchemeIs("http") || url.SchemeIs("https")) {
     if (response.httpStatusCode() < 100 || response.httpStatusCode() >= 400) {
       // The plugin instance could be in the process of deletion here.
       // Verify if the WebPluginResourceClient instance still exists before
       // use.
-      WebPluginResourceClient* resource_client = GetClientFromLoader(loader);
-      if (resource_client) {
-        loader->cancel();
-        resource_client->DidFail();
-        RemoveClient(loader);
+      ClientInfo* client_info = GetClientInfoFromLoader(loader);
+      if (client_info) {
+        client_info->pending_failure_notification = true;
       }
     }
   }
 }
 
 void WebPluginImpl::didReceiveData(WebURLLoader* loader,
                                    const char *buffer,
                                    int length, long long) {
   WebPluginResourceClient* client = GetClientFromLoader(loader);
   if (!client)
@@ skipping 148 matching lines @@
   }
 
   ClientInfo info;
   info.id = resource_id;
   info.client = client;
   info.request.initialize();
   info.request.setURL(url);
   info.request.setRequestorProcessID(delegate_->GetProcessId());
   info.request.setTargetType(WebURLRequest::TargetIsObject);
   info.request.setHTTPMethod(WebString::fromUTF8(method));
+  info.pending_failure_notification = false;
 
   if (range_info) {
     info.request.addHTTPHeaderField(WebString::fromUTF8("Range"),
                                     WebString::fromUTF8(range_info));
   }
 
   if (strcmp(method, "POST") == 0) {
     // Adds headers or form data to a request.  This must be called before
     // we initiate the actual request.
     SetPostData(&info.request, buf, buf_len);
@@ skipping 40 matching lines @@
       true);
 }
 
 void WebPluginImpl::SetDeferResourceLoading(int resource_id, bool defer) {
   std::vector<ClientInfo>::iterator client_index = clients_.begin();
   while (client_index != clients_.end()) {
     ClientInfo& client_info = *client_index;
 
     if (client_info.id == resource_id) {
       client_info.loader->setDefersLoading(defer);
+
+      // If we determined that the request had failed via the HTTP headers
+      // in the response then we send out a failure notification to the
+      // plugin process, as certain plugins don't handle HTTP failure codes
+      // correctly.
+      if (!defer && client_info.client &&
+          client_info.pending_failure_notification) {
+        client_info.loader->cancel();
+        client_info.client->DidFail();
+        clients_.erase(client_index++);
+      }
       break;
     }
     client_index++;
   }
 }
 
 void WebPluginImpl::HandleHttpMultipartResponse(
     const WebURLResponse& response, WebPluginResourceClient* client) {
   std::string multipart_boundary;
   if (!MultipartResponseDelegate::ReadMultipartBoundary(
@@ skipping 107 matching lines @@
     ClientInfo& client_info = *client_index;
 
     if (loader_to_ignore == client_info.loader) {
       client_index++;
       continue;
     }
 
     if (client_info.loader.get())
       client_info.loader->cancel();
 
-    WebPluginResourceClient* resource_client = client_info.client;
     client_index = clients_.erase(client_index);
-    if (resource_client)
-      resource_client->DidFail();
   }
 
   // This needs to be called now and not in the destructor since the
   // webframe_ might not be valid anymore.
   webframe_->set_plugin_delegate(NULL);
   webframe_ = NULL;
   method_factory_.RevokeAll();
 }
 
 WebViewDelegate* WebPluginImpl::GetWebViewDelegate() {
   if (!webframe_)
     return NULL;
   WebViewImpl* webview = webframe_->GetWebViewImpl();
   return webview ? webview->delegate() : NULL;
 }