Fix a crash that the reliability bots caught....

webkit/api/src/WebPluginContainerImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 237 matching lines @@
     const WebURLRequest& request, const WebString& target, bool notifyNeeded, void* notifyData)
 {
     Frame* frame = m_element->document()->frame();
     if (!frame)
         return;  // FIXME: send a notification in this case?
 
     if (notifyNeeded) {
         // FIXME: This is a bit of hack to allow us to observe completion of
         // our frame request.  It would be better to evolve FrameLoader to
         // support a completion callback instead.
-        WebDataSourceImpl::setNextPluginLoadObserver(
-            new WebPluginLoadObserver(this, request.url(), notifyData));
+        WebPluginLoadObserver* observer =
+            new WebPluginLoadObserver(this, request.url(), notifyData);
+        m_pluginLoadObservers.append(observer);
+        WebDataSourceImpl::setNextPluginLoadObserver(observer);
     }
 
     FrameLoadRequest frameRequest(request.toResourceRequest());
     frameRequest.setFrameName(target);
 
     frame->loader()->loadFrameRequest(
         frameRequest,
         false,  // lock history
         false,  // lock back forward list
         0,      // event
@@ skipping 35 matching lines @@
     size_t pos = m_pluginLoadObservers.find(observer);
     if (pos == notFound)
         return;
     m_pluginLoadObservers.remove(pos);
 }
 
 // Private methods -------------------------------------------------------------
 
 WebPluginContainerImpl::~WebPluginContainerImpl()
 {
+    for (size_t i = 0; i < m_pluginLoadObservers.size(); ++i)
+        m_pluginLoadObservers[i]->clearPluginContainer();
     m_webPlugin->destroy();
 }
 
 void WebPluginContainerImpl::handleMouseEvent(MouseEvent* event)
 {
     ASSERT(parent()->isFrameView());
 
     // We cache the parent FrameView here as the plugin widget could be deleted
     // in the call to HandleEvent. See http://b/issue?id=1362948
     FrameView* parentView = static_cast<FrameView*>(parent());
@@ skipping 186 matching lines @@
                     roundedIntPoint(iframeRenderer->localToAbsolute());
                 RenderBox* rbox = toRenderBox(iframeRenderer);
                 IntSize size(rbox->width(), rbox->height());
                 cutOutRects.append(IntRect(point, size));
             }
         }
     }
 }
 
 } // namespace WebKit