Ensure that in-process plugins can't destroy themselves by closing a URLLoader

content/renderer/pepper/pepper_plugin_instance_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 3102 matching lines @@
   if (lock_target_.get()) {
     GetMouseLockDispatcher()->OnLockTargetDestroyed(lock_target_.get());
     lock_target_.reset();
   }
 }
 
 void PepperPluginInstanceImpl::DidDataFromWebURLResponse(
     const blink::WebURLResponse& response,
     int pending_host_id,
     const ppapi::URLResponseInfoData& data) {
+  if (is_deleted_)
+    return;
+
   RendererPpapiHostImpl* host_impl = module_->renderer_ppapi_host();
 
   if (host_impl->in_process_router()) {
     // Running in-process, we can just create the resource and call the
     // PPP_Instance function directly.
     scoped_refptr<ppapi::proxy::URLLoaderResource> loader_resource(
         new ppapi::proxy::URLLoaderResource(
             host_impl->in_process_router()->GetPluginConnection(pp_instance()),
             pp_instance(),
             pending_host_id,
@@ skipping 11 matching lines @@
     // Running out-of-process. Initiate an IPC call to notify the plugin
     // process.
     ppapi::proxy::HostDispatcher* dispatcher =
         ppapi::proxy::HostDispatcher::GetForInstance(pp_instance());
     dispatcher->Send(new PpapiMsg_PPPInstance_HandleDocumentLoad(
         ppapi::API_ID_PPP_INSTANCE, pp_instance(), pending_host_id, data));
   }
 }
 
 }  // namespace content