Fix scripting during NPP_Destroy. Note that if the plugin is making a call t...

chrome/renderer/webplugin_delegate_proxy.h

-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_RENDERER_WEBPLUGIN_DELEGATE_PROXY_H__
 #define CHROME_RENDERER_WEBPLUGIN_DELEGATE_PROXY_H__
 
 #include <string>
 #include <vector>
 
 #include "base/file_path.h"
@@ skipping 26 matching lines @@
 // the plugin process.
 class WebPluginDelegateProxy :
     public webkit_glue::WebPluginDelegate,
     public IPC::Channel::Listener,
     public IPC::Message::Sender,
     public base::SupportsWeakPtr<WebPluginDelegateProxy> {
  public:
   WebPluginDelegateProxy(const std::string& mime_type,
                          const base::WeakPtr<RenderView>& render_view);
 
-  // Called to drop our pointer to the window script object.
-  void DropWindowScriptObject() { window_script_object_ = NULL; }
-
   // WebPluginDelegate implementation:
   virtual void PluginDestroyed();
   virtual bool Initialize(const GURL& url,
                           const std::vector<std::string>& arg_names,
                           const std::vector<std::string>& arg_values,
                           webkit_glue::WebPlugin* plugin,
                           bool load_manually);
   virtual void UpdateGeometry(const gfx::Rect& window_rect,
                               const gfx::Rect& clip_rect);
   virtual void Paint(gfx::NativeDrawingContext context, const gfx::Rect& rect);
@@ skipping 103 matching lines @@
   bool windowless_;
   gfx::PluginWindowHandle window_;
   scoped_refptr<PluginChannelHost> channel_host_;
   std::string mime_type_;
   int instance_id_;
   WebPluginInfo info_;
 
   gfx::Rect plugin_rect_;
 
   NPObject* npobject_;
-  NPObjectStub* window_script_object_;
+  base::WeakPtr<NPObjectStub> window_script_object_;
 
   // Event passed in by the plugin process and is used to decide if
   // messages need to be pumped in the NPP_HandleEvent sync call.
   scoped_ptr<base::WaitableEvent> modal_loop_pump_messages_event_;
 
   // Bitmap for crashed plugin
   SkBitmap* sad_plugin_;
 
   // True if we got an invalidate from the plugin and are waiting for a paint.
   bool invalidate_pending_;
@@ skipping 13 matching lines @@
   // This lets us know which portion of the backing store has been painted into.
   gfx::Rect backing_store_painted_;
 
   // The url of the main frame hosting the plugin.
   GURL page_url_;
 
   DISALLOW_EVIL_CONSTRUCTORS(WebPluginDelegateProxy);
 };
 
 #endif  // CHROME_RENDERER_WEBPLUGIN_DELEGATE_PROXY_H_