Fix scripting during NPP_Destroy. Note that if the plugin is making a call t...

chrome/plugin/plugin_channel.cc

Index: chrome/plugin/plugin_channel.cc
===================================================================
--- chrome/plugin/plugin_channel.cc	(revision 28004)
+++ chrome/plugin/plugin_channel.cc	(working copy)
@@ -222,11 +222,18 @@
                                       IPC::Message* reply_msg) {
   for (size_t i = 0; i < plugin_stubs_.size(); ++i) {
     if (plugin_stubs_[i]->instance_id() == instance_id) {
-      filter_->ReleaseModalDialogEvent(
-          plugin_stubs_[i]->webplugin()->containing_window());
+      scoped_refptr<MessageFilter> filter(filter_);
+      gfx::NativeViewId window =
+          plugin_stubs_[i]->webplugin()->containing_window();
       plugin_stubs_.erase(plugin_stubs_.begin() + i);
+      Send(reply_msg);
       RemoveRoute(instance_id);
-      Send(reply_msg);

[jam, 2009/10/06 07:10:48]

note: this was using *this* object after RemoveRoute, which could have deleted
it.

+      // NOTE: *this* might be deleted as a result of calling RemoveRoute.
+      // Don't release the modal dialog event right away, but do it after the
+      // stack unwinds since the plugin can be destroyed later if it's in use
+      // right now.
+      MessageLoop::current()->PostNonNestableTask(FROM_HERE, NewRunnableMethod(
+          filter.get(), &MessageFilter::ReleaseModalDialogEvent, window));
       return;
     }
   }