Change the PepperInProcessRouter to defer resource destruction messages.

ppapi/proxy/url_loader_resource.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/url_loader_resource.h"
 
 #include "base/logging.h"
 #include "ppapi/c/pp_completion_callback.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/ppb_url_loader.h"
@@ skipping 50 matching lines @@
       user_buffer_(NULL),
       user_buffer_size_(0),
       done_status_(PP_OK_COMPLETIONPENDING),
       is_streaming_to_file_(false),
       is_asynchronous_load_suspended_(false) {
   AttachToPendingHost(RENDERER, pending_main_document_loader_id);
   SaveResponseInfo(data);
 }
 
 URLLoaderResource::~URLLoaderResource() {
+  // Destroying a loader will cancel a pending load which causes the document
+  // ready state to change. A page may respond to that event by destroying the
+  // plugin instance. For in-process plugins, this can re-enter the proxy code
+  // before the base Resource destructor removes the loader from the resource
+  // tracker. The instance cleanup code will then attempt to call methods on
+  // this partially destructed object. Remove the loader from the tracker now
+  // to avoid this.
+  if (PpapiGlobals::Get()->GetProxyLock() == NULL)

[Tom Sepez, 2013/09/09 21:05:01]

nit: (!PpapiGlobals::Get()->GetProxyLock())

+    RemoveFromResourceTracker();
 }
 
 PPB_URLLoader_API* URLLoaderResource::AsPPB_URLLoader_API() {
   return this;
 }
 
 int32_t URLLoaderResource::Open(PP_Resource request_id,
                                 scoped_refptr<TrackedCallback> callback) {
   EnterResourceNoLock<PPB_URLRequestInfo_API> enter_request(request_id, true);
   if (enter_request.failed()) {
@@ skipping 302 matching lines @@
   }
 
   // Reset for next time.
   user_buffer_ = NULL;
   user_buffer_size_ = 0;
   return bytes_to_copy;
 }
 
 }  // namespace proxy
 }  // namespace ppapi