Change the PepperInProcessRouter to defer resource destruction messages.

ppapi/proxy/url_loader_resource.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/url_loader_resource.h"
 
 #include "base/logging.h"
 #include "ppapi/c/pp_completion_callback.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/ppb_url_loader.h"
@@ skipping 50 matching lines @@
       user_buffer_(NULL),
       user_buffer_size_(0),
       done_status_(PP_OK_COMPLETIONPENDING),
       is_streaming_to_file_(false),
       is_asynchronous_load_suspended_(false) {
   AttachToPendingHost(RENDERER, pending_main_document_loader_id);
   SaveResponseInfo(data);
 }
 
 URLLoaderResource::~URLLoaderResource() {
+  // Destroying a URLLoaderResource can cause the page to tear down the plugin

[yzshen1, 2013/09/06 22:07:47]

I don't quite understand under what circumstances destroying URLLoaderResource
will cause the page to tear down the plugin. Would you please talk about that?

+  // instance. For in-process plugins, this can happen before the base Resource
+  // class destructor runs, which removes this from the resource tracker. The
+  // instance tear down code will then attempt to call methods on this partially
+  // destructed object. Remove this from the tracker early to avoid this.
+  RemoveFromResourceTracker();
 }
 
 PPB_URLLoader_API* URLLoaderResource::AsPPB_URLLoader_API() {
   return this;
 }
 
 int32_t URLLoaderResource::Open(PP_Resource request_id,
                                 scoped_refptr<TrackedCallback> callback) {
   EnterResourceNoLock<PPB_URLRequestInfo_API> enter_request(request_id, true);
   if (enter_request.failed()) {
@@ skipping 302 matching lines @@
   }
 
   // Reset for next time.
   user_buffer_ = NULL;
   user_buffer_size_ = 0;
   return bytes_to_copy;
 }
 
 }  // namespace proxy
 }  // namespace ppapi