This fixes http://code.google.com/p/chromium/issues/detail?id=2472, which...

chrome/plugin/npobject_stub.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/plugin/npobject_stub.h"
 
 #include "chrome/common/plugin_messages.h"
 #include "chrome/plugin/npobject_util.h"
 #include "chrome/plugin/plugin_channel_base.h"
 #include "chrome/renderer/webplugin_delegate_proxy.h"
@@ skipping 242 matching lines @@
   for (unsigned int i = 0; i < count; ++i) {
     NPIdentifier_Param param;
     CreateNPIdentifierParam(value_np[i], &param);
     value->push_back(param);
   }
 
   NPN_MemFree(value_np);
 }
 
 void NPObjectStub::OnEvaluate(const std::string& script,
+                              bool popups_allowed,
                               IPC::Message* reply_msg) {
   if (IsPluginProcess()) {
     NOTREACHED() << "Should only be called on NPObjects in the renderer";
     return;
   }
 
   // Grab a reference to the underlying channel, as the NPObjectStub
   // instance can be destroyed in the context of NPN_Evaluate. This
   // can happen if the containing plugin instance is destroyed in
   // NPN_Evaluate.
   scoped_refptr<PluginChannelBase> local_channel = channel_;
 
   NPVariant result_var;
   NPString script_string;
   script_string.UTF8Characters = script.c_str();
   script_string.UTF8Length = static_cast<unsigned int>(script.length());
 
-  bool return_value = NPN_Evaluate(0, npobject_, &script_string, &result_var);
+  bool return_value = NPN_EvaluateHelper(0, popups_allowed, npobject_,
+                                         &script_string, &result_var);
 
   NPVariant_Param result_param;
   CreateNPVariantParam(result_var, local_channel, &result_param, true);
   NPObjectMsg_Evaluate::WriteReplyParams(reply_msg, result_param, return_value);
   local_channel->Send(reply_msg);
 }
 
 void NPObjectStub::OnSetException(const std::string& message) {
   if (IsPluginProcess()) {
     NOTREACHED() << "Should only be called on NPObjects in the renderer";
     return;
   }
 
   NPN_SetException(npobject_, message.c_str());
 }