Change the PepperInProcessRouter to defer resource destruction messages.

ppapi/proxy/url_loader_resource.cc

Index: ppapi/proxy/url_loader_resource.cc
diff --git a/ppapi/proxy/url_loader_resource.cc b/ppapi/proxy/url_loader_resource.cc
index 5bbc9372ff2dbea3af1b098d4a70a2673a93c211..fcaa384d3f27f85598ea466641cb30870ae850af 100644
--- a/ppapi/proxy/url_loader_resource.cc
+++ b/ppapi/proxy/url_loader_resource.cc
@@ -68,6 +68,15 @@ URLLoaderResource::URLLoaderResource(Connection connection,
 }
 
 URLLoaderResource::~URLLoaderResource() {
+  // Destroying a loader will cancel a pending load which causes the document
+  // ready state to change. A page may respond to that event by destroying the
+  // plugin instance. For in-process plugins, this can re-enter the proxy code
+  // before the base Resource destructor removes the loader from the resource
+  // tracker. The instance cleanup code will then attempt to call methods on
+  // this partially destructed object. Remove the loader from the tracker now
+  // to avoid this.
+  if (PpapiGlobals::Get()->GetProxyLock() == NULL)

[Tom Sepez, 2013/09/09 21:05:01]

nit: (!PpapiGlobals::Get()->GetProxyLock())

+    RemoveFromResourceTracker();
 }
 
 PPB_URLLoader_API* URLLoaderResource::AsPPB_URLLoader_API() {