Fix a plugin crash due to ResourceDispatcher being used after it was deleted...

chrome/plugin/plugin_thread.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <windows.h>
 #include <objbase.h>
 
 #include "chrome/plugin/plugin_thread.h"
 
 #include "base/command_line.h"
@@ skipping 51 matching lines @@
   if (plugin.get()) {
     plugin->NP_Initialize();
   }
 
   // Certain plugins, such as flash, steal the unhandled exception filter
   // thus we never get crash reports when they fault. This call fixes it.
   message_loop()->set_exception_restoration(true);
 }
 
 void PluginThread::CleanUp() {
-  ChildThread::CleanUp();
   if (preloaded_plugin_module_) {
     FreeLibrary(preloaded_plugin_module_);
     preloaded_plugin_module_ = NULL;
   }
   PluginChannelBase::CleanupChannels();
   NPAPI::PluginLib::UnloadAllPlugins();
   ChromePluginLib::UnloadAllPlugins();
   notification_service_.reset();
   CoUninitialize();
 
   if (webkit_glue::ShouldForcefullyTerminatePluginProcess())
     TerminateProcess(GetCurrentProcess(), 0);
+
+  // Call this last because it deletes the ResourceDispatcher, which is used
+  // in some of the above cleanup.
+  // See http://code.google.com/p/chromium/issues/detail?id=8980
+  ChildThread::CleanUp();
 }
 
 void PluginThread::OnCreateChannel() {
   std::wstring channel_name;
   scoped_refptr<PluginChannel> channel =
       PluginChannel::GetPluginChannel(owner_loop());
   if (channel.get())
     channel_name = channel->channel_name();
 
   Send(new PluginProcessHostMsg_ChannelCreated(channel_name));
@@ skipping 73 matching lines @@
   }
 
   if (!result || net_error != net::OK)
     return false;
 
   *proxy_list = proxy_result;
   return true;
 }
 
 } // namespace webkit_glue