Change the PepperInProcessRouter to defer resource destruction messages.

content/renderer/pepper/pepper_in_process_router.cc

Index: content/renderer/pepper/pepper_in_process_router.cc
diff --git a/content/renderer/pepper/pepper_in_process_router.cc b/content/renderer/pepper/pepper_in_process_router.cc
index d5c0d429a40d40f1e17938a32785dc2a63f3160d..0bd8089a6d8084acffcf150f6183e4b2a399e8f7 100644
--- a/content/renderer/pepper/pepper_in_process_router.cc
+++ b/content/renderer/pepper/pepper_in_process_router.cc
@@ -110,8 +110,12 @@ bool PepperInProcessRouter::SendToHost(IPC::Message* msg) {
   scoped_ptr<IPC::Message> message(msg);
 
   if (!message->is_sync()) {
-    bool result = host_impl_->GetPpapiHost()->OnMessageReceived(*message);
-    DCHECK(result) << "The message was not handled by the host.";
+    // Dispatch host messages from the message loop.
+    base::MessageLoop::current()->PostTask(

[dmichael (off chromium), 2013/09/10 18:34:35]

Wow, we should have been doing this from the very beginning with
PepperInProcessRouter. Thanks for fixing it.

+        FROM_HERE,
+        base::Bind(&PepperInProcessRouter::DispatchHostMsg,
+                   weak_factory_.GetWeakPtr(),
+                   base::Owned(message.release())));
     return true;
   }
 
@@ -146,6 +150,11 @@ bool PepperInProcessRouter::SendToPlugin(IPC::Message* msg) {
   return true;
 }
 
+void PepperInProcessRouter::DispatchHostMsg(IPC::Message* msg) {
+  bool handled = host_impl_->GetPpapiHost()->OnMessageReceived(*msg);
+  DCHECK(handled);
+}
+
 void PepperInProcessRouter::DispatchPluginMsg(IPC::Message* msg) {
   bool handled = OnPluginMsgReceived(*msg);
   DCHECK(handled);