Fix scripting during NPP_Destroy. Note that if the plugin is making a call t...

chrome/plugin/webplugin_delegate_stub.cc

-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/plugin/webplugin_delegate_stub.h"
 
 #include "build/build_config.h"
 
 #include "base/command_line.h"
 #include "chrome/common/child_process_logging.h"
 #include "chrome/common/chrome_switches.h"
@@ skipping 33 matching lines @@
   WebPluginDelegateImpl* delegate_;
   WebPlugin* webplugin_;
 };
 
 WebPluginDelegateStub::WebPluginDelegateStub(
     const std::string& mime_type, int instance_id, PluginChannel* channel) :
     mime_type_(mime_type),
     instance_id_(instance_id),
     channel_(channel),
     delegate_(NULL),
-    webplugin_(NULL) {
+    webplugin_(NULL),
+    in_destructor_(false) {
   DCHECK(channel);
 }
 
 WebPluginDelegateStub::~WebPluginDelegateStub() {
+  in_destructor_ = true;
   child_process_logging::ScopedActiveURLSetter url_setter(page_url_);
 
   if (channel_->in_send()) {
     // The delegate or an npobject is in the callstack, so don't delete it
     // right away.
     MessageLoop::current()->PostNonNestableTask(FROM_HERE,
         new FinishDestructionTask(delegate_, webplugin_));
   } else {
     // Safe to delete right away.
     if (delegate_)
       delegate_->PluginDestroyed();
 
     delete webplugin_;
   }
 }
 
 void WebPluginDelegateStub::OnMessageReceived(const IPC::Message& msg) {
   child_process_logging::ScopedActiveURLSetter url_setter(page_url_);
 
   // A plugin can execute a script to delete itself in any of its NPP methods.
   // Hold an extra reference to ourself so that if this does occur and we're
   // handling a sync message, we don't crash when attempting to send a reply.
-  AddRef();
+  // The exception to this is when we're already in the destructor.
+  if (!in_destructor_)
+    AddRef();
 
   IPC_BEGIN_MESSAGE_MAP(WebPluginDelegateStub, msg)
     IPC_MESSAGE_HANDLER(PluginMsg_Init, OnInit)
     IPC_MESSAGE_HANDLER(PluginMsg_WillSendRequest, OnWillSendRequest)
     IPC_MESSAGE_HANDLER(PluginMsg_DidReceiveResponse, OnDidReceiveResponse)
     IPC_MESSAGE_HANDLER(PluginMsg_DidReceiveData, OnDidReceiveData)
     IPC_MESSAGE_HANDLER(PluginMsg_DidFinishLoading, OnDidFinishLoading)
     IPC_MESSAGE_HANDLER(PluginMsg_DidFail, OnDidFail)
     IPC_MESSAGE_HANDLER(PluginMsg_DidFinishLoadWithReason,
                         OnDidFinishLoadWithReason)
@@ skipping 13 matching lines @@
     IPC_MESSAGE_HANDLER(PluginMsg_DidReceiveManualData, OnDidReceiveManualData)
     IPC_MESSAGE_HANDLER(PluginMsg_DidFinishManualLoading,
                         OnDidFinishManualLoading)
     IPC_MESSAGE_HANDLER(PluginMsg_DidManualLoadFail, OnDidManualLoadFail)
     IPC_MESSAGE_HANDLER(PluginMsg_InstallMissingPlugin, OnInstallMissingPlugin)
     IPC_MESSAGE_HANDLER(PluginMsg_HandleURLRequestReply,
                         OnHandleURLRequestReply)
     IPC_MESSAGE_UNHANDLED_ERROR()
   IPC_END_MESSAGE_MAP()
 
-  Release();
+  if (!in_destructor_)
+    Release();
 }
 
 bool WebPluginDelegateStub::Send(IPC::Message* msg) {
   return channel_->Send(msg);
 }
 
 void WebPluginDelegateStub::OnInit(const PluginMsg_Init_Params& params,
                                    bool* result) {
   page_url_ = params.page_url;
   child_process_logging::ScopedActiveURLSetter url_setter(page_url_);
@@ skipping 233 matching lines @@
 
 void WebPluginDelegateStub::OnHandleURLRequestReply(
     const PluginMsg_URLRequestReply_Params& params) {
   WebPluginResourceClient* resource_client =
       delegate_->CreateResourceClient(params.resource_id, params.url,
                                       params.notify_needed,
                                       params.notify_data,
                                       params.stream);
   webplugin_->OnResourceCreated(params.resource_id, resource_client);
 }