Checks if the plugin has gone away inside of HandleURLRequestInternal()

webkit/glue/webplugin_impl.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/gfx/rect.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "net/base/escape.h"
@@ skipping 823 matching lines @@
       return;
 
     // If the RouteToFrame call returned a failure then inform the result
     // back to the plugin asynchronously.
     if ((routing_status == INVALID_URL) ||
         (routing_status == GENERAL_FAILURE)) {
       resource_client->DidFail();
       return;
     }
 
+    // CreateResourceClient() sends a synchronous IPC message so it's possible
+    // that TearDownPluginInstance() may have been called in the nested
+    // message loop.  If so, don't start the request.
+    if (!delegate_)
+      return;
+
     InitiateHTTPRequest(resource_id, resource_client, method, buf, len,
                         complete_url, NULL, use_plugin_src_as_referrer);
   }
 }
 
 int WebPluginImpl::GetNextResourceId() {
   static int next_id = 0;
   return ++next_id;
 }
 
@@ skipping 197 matching lines @@
     client_index = clients_.erase(client_index);
   }
 
   // This needs to be called now and not in the destructor since the
   // webframe_ might not be valid anymore.
   webframe_ = NULL;
   method_factory_.RevokeAll();
 }
 
 }  // namespace webkit_glue