This CL fixes the document-open.html and window-open.html plugin layout tests...

webkit/glue/plugins/plugin_stream_url.cc

Index: webkit/glue/plugins/plugin_stream_url.cc
===================================================================
--- webkit/glue/plugins/plugin_stream_url.cc	(revision 31913)
+++ webkit/glue/plugins/plugin_stream_url.cc	(working copy)
@@ -29,6 +29,9 @@
 }
 
 bool PluginStreamUrl::Close(NPReason reason) {
+  // Protect the stream against it being destroyed or the whole plugin instance
+  // being destroyed within the destroy stream handler.
+  scoped_refptr<PluginStream> protect(this);
   CancelRequest();
   bool result = PluginStream::Close(reason);
   instance()->RemoveStream(this);
@@ -45,6 +48,10 @@
                                          uint32 expected_length,
                                          uint32 last_modified,
                                          bool request_is_seekable) {
+  // Protect the stream against it being destroyed or the whole plugin instance
+  // being destroyed within the new stream handler.
+  scoped_refptr<PluginStream> protect(this);
+
   bool opened = Open(mime_type,
                      headers,
                      expected_length,
@@ -64,6 +71,10 @@
   if (!open())
     return;
 
+  // Protect the stream against it being destroyed or the whole plugin instance
+  // being destroyed within the write handlers
+  scoped_refptr<PluginStream> protect(this);
+
   if (length > 0) {
     // The PluginStreamUrl instance could get deleted if the plugin fails to
     // accept data in NPP_Write.