PPAPI: Fix GetBrowserInterface race conditions

ppapi/proxy/plugin_globals.cc

Index: ppapi/proxy/plugin_globals.cc
diff --git a/ppapi/proxy/plugin_globals.cc b/ppapi/proxy/plugin_globals.cc
index 82e16ffe328582f2a5bade188fad7057d1e4e4be..63bcb4490bca12359a800cc2adf6a755fe3c863a 100644
--- a/ppapi/proxy/plugin_globals.cc
+++ b/ppapi/proxy/plugin_globals.cc
@@ -192,11 +192,13 @@ void PluginGlobals::MarkPluginIsActive() {
 }
 
 IPC::Sender* PluginGlobals::GetBrowserSender() {
-  if (!browser_sender_.get()) {
-    browser_sender_.reset(
-        new BrowserSender(plugin_proxy_delegate_->GetBrowserSender()));
-  }
-
+  // CAUTION: This function is called without the ProxyLock. See also
+  // InterfaceList::GetInterfaceForPPB.
+  //
+  // See also SetPluginProxyDelegate. That initializes browser_sender_ before
+  // the plugin can start threads, and it may be cleared after the
+  // plugin has torn down threads. So this pointer is expected to remain valid
+  // during the lifetime of the plugin.
   return browser_sender_.get();
 }
 
@@ -217,6 +219,19 @@ PP_Resource PluginGlobals::CreateBrowserFont(
       connection, instance, desc, prefs);
 }
 
+void PluginGlobals::SetPluginProxyDelegate(PluginProxyDelegate* delegate) {
+  DCHECK(delegate && !plugin_proxy_delegate_);
+  plugin_proxy_delegate_ = delegate;
+  browser_sender_.reset(
+      new BrowserSender(plugin_proxy_delegate_->GetBrowserSender()));
+}
+
+void PluginGlobals::ResetPluginProxyDelegate() {
+  DCHECK(plugin_proxy_delegate_);
+  plugin_proxy_delegate_ = NULL;
+  browser_sender_.reset();
+}
+
 MessageLoopResource* PluginGlobals::loop_for_main_thread() {
   return loop_for_main_thread_.get();
 }