Fix scripting during NPP_Destroy. Note that if the plugin is making a call t...

chrome/plugin/plugin_channel.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/plugin/plugin_channel.h"
 
 #include "base/command_line.h"
 #include "base/lock.h"
 #include "base/process_util.h"
 #include "base/string_util.h"
@@ skipping 204 matching lines @@
   scoped_refptr<WebPluginDelegateStub> stub = new WebPluginDelegateStub(
       mime_type, *instance_id, this);
   AddRoute(*instance_id, stub, false);
   plugin_stubs_.push_back(stub);
 }
 
 void PluginChannel::OnDestroyInstance(int instance_id,
                                       IPC::Message* reply_msg) {
   for (size_t i = 0; i < plugin_stubs_.size(); ++i) {
     if (plugin_stubs_[i]->instance_id() == instance_id) {
-      filter_->ReleaseModalDialogEvent(
-          plugin_stubs_[i]->webplugin()->containing_window());
+      scoped_refptr<MessageFilter> filter(filter_);
+      gfx::NativeViewId window =
+          plugin_stubs_[i]->webplugin()->containing_window();
       plugin_stubs_.erase(plugin_stubs_.begin() + i);
+      Send(reply_msg);
       RemoveRoute(instance_id);
-      Send(reply_msg);

[jam, 2009/10/06 07:10:48]

note: this was using *this* object after RemoveRoute, which could have deleted
it.

+      // NOTE: *this* might be deleted as a result of calling RemoveRoute.
+      // Don't release the modal dialog event right away, but do it after the
+      // stack unwinds since the plugin can be destroyed later if it's in use
+      // right now.
+      MessageLoop::current()->PostNonNestableTask(FROM_HERE, NewRunnableMethod(
+          filter.get(), &MessageFilter::ReleaseModalDialogEvent, window));
       return;
     }
   }
 
   NOTREACHED() << "Couldn't find WebPluginDelegateStub to destroy";
 }
 
 void PluginChannel::OnGenerateRouteID(int* route_id) {
   *route_id = GenerateRouteID();
 }
@@ skipping 49 matching lines @@
   int plugin_fd;
   IPC::SocketPair(&plugin_fd, &renderer_fd_);
   IPC::AddChannelSocket(channel_name(), plugin_fd);
 #endif
   if (!PluginChannelBase::Init(ipc_message_loop, create_pipe_now))
     return false;
 
   channel_->AddFilter(filter_.get());
   return true;
 }