Ensure that in-process plugins can't destroy themselves by closing a URLLoader

content/renderer/pepper/pepper_url_loader_host.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_url_loader_host.h"
 
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 #include "content/renderer/pepper/renderer_ppapi_host_impl.h"
 #include "content/renderer/pepper/url_request_info_util.h"
 #include "content/renderer/pepper/url_response_info_util.h"
@@ skipping 343 matching lines @@
     pending_replies_.push_back(message);
   } else {
     host()->SendUnsolicitedReply(pp_resource(), *message);
     delete message;
   }
 }
 
 void PepperURLLoaderHost::Close() {
   if (loader_.get())
     loader_->cancel();
-  else if (main_document_loader_)
-    GetFrame()->stopLoading();
+  else if (main_document_loader_) {
+    blink::WebFrame* frame = GetFrame();
+    if (frame)
+      frame->stopLoading();
+  }
 }
 
 blink::WebLocalFrame* PepperURLLoaderHost::GetFrame() {
   PepperPluginInstance* instance_object =
       renderer_ppapi_host_->GetPluginInstance(pp_instance());
   if (!instance_object)
     return NULL;
   return instance_object->GetContainer()->element().document().frame();
 }
 
@@ skipping 44 matching lines @@
     ppapi::proxy::ResourceMessageReplyParams params;
     SendUpdateToPlugin(new PpapiPluginMsg_URLLoader_UpdateProgress(
         record_upload ? bytes_sent_ : -1,
         record_upload ? total_bytes_to_be_sent_ : -1,
         record_download ? bytes_received_ : -1,
         record_download ? total_bytes_to_be_received_ : -1));
   }
 }
 
 }  // namespace content