Fix scripting during NPP_Destroy. Note that if the plugin is making a call t...

Fix scripting during NPP_Destroy.  Note that if the plugin is making a call to the renderer so this instance is in the callstack, destruction will have to be asynchronous and so scripting still won't work.  This change also fixes use of PluginChannel after it's deleted (if this was the last instance).

BUG=23713, 23706
TEST=added ui test

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=28141

[jam, 2009-10-06 07:10:48]

http://codereview.chromium.org/258026/diff/4008/5020
File chrome/plugin/npobject_stub.cc (left):

http://codereview.chromium.org/258026/diff/4008/5020#oldcode88
Line 88: npobject_ = NULL;
note: I tracked this code to
http://chrome-corpsvn.mtv/viewvc?view=rev&root=chrome&revision=11685, which was
a crash in LayoutPluginTester.UnloadNoCrash.  This code isn't needed anymore
since we now unload the plugin dll at process destruction, which is after we
have released all the NPObjectStub objects.  The test also runs fine with this
change.

http://codereview.chromium.org/258026/diff/4008/5010
File chrome/plugin/plugin_channel.cc (left):

http://codereview.chromium.org/258026/diff/4008/5010#oldcode229
Line 229: Send(reply_msg);
note: this was using *this* object after RemoveRoute, which could have deleted
it.

http://codereview.chromium.org/258026/diff/4008/5011
File chrome/renderer/webplugin_delegate_proxy.cc (left):

http://codereview.chromium.org/258026/diff/4008/5011#oldcode182
Line 182: plugin_ = NULL;
setting plugin_ to null and calling RemoveRoute before calling the plugin were
done in http://chrome-corpsvn.mtv/viewvc?view=rev&root=chrome&revision=34289.  I
couldn't repro this crash, but I didn't use find any specific test cases. 
However I'm taking out the existing code and implementing the NPAPI functions
and will test with those changes.

http://codereview.chromium.org/258026/diff/4008/5011#oldcode188
Line 188: WebBindings::releaseObject(npobject_);
this was added in
http://chrome-corpsvn.mtv/viewvc?view=rev&root=chrome&revision=32474 but isn't
needed anymore because of the corresponding change in
NPObjectStub::OnChannelError which stops nulling out npobject_.

[ananta, 2009-10-06 18:18:24]

LGTM++

http://codereview.chromium.org/258026/diff/4008/5013
File webkit/glue/plugins/test/plugin_test.cc (right):

http://codereview.chromium.org/258026/diff/4008/5013#newcode92
Line 92: if (!window_obj)
Nit: maybe we should do this at the top of this function to avoid all the
appends?. An unlikely scenario though.

[jam, 2009-10-06 19:12:39]

http://codereview.chromium.org/258026/diff/4008/5013
File webkit/glue/plugins/test/plugin_test.cc (right):

http://codereview.chromium.org/258026/diff/4008/5013#newcode92
Line 92: if (!window_obj)
On 2009/10/06 18:18:24, ananta wrote:
> Nit: maybe we should do this at the top of this function to avoid all the
> appends?. An unlikely scenario though.

Done.