Early return from WebPluginContainerImpl::scriptableObject if the plugin gets destroyed

Source/web/WebPluginContainerImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 573 matching lines @@
 }
 
 WebLayer* WebPluginContainerImpl::platformLayer() const
 {
     return m_webLayer;
 }
 
 v8::Local<v8::Object> WebPluginContainerImpl::scriptableObject(v8::Isolate* isolate)
 {
     v8::Local<v8::Object> object = m_webPlugin->v8ScriptableObject(isolate);
+    // |m_webPlugin| may be destroyed during the above line due to re-entrancy
+    // caused by sync messages to the plugin. If this is the case just return an
+    // empty handle. crbug.com/423263.
+    if (!m_webPlugin)
+        return v8::Local<v8::Object>();
+
     if (!object.IsEmpty()) {
         // WebPlugin implementation can't provide the obsolete NPObject at the same time:
         ASSERT(!m_webPlugin->scriptableObject());
         return object;
     }
 
     NPObject* npObject = m_webPlugin->scriptableObject();
     if (npObject)
         return createV8ObjectForNPObject(isolate, npObject, 0);
     return v8::Local<v8::Object>();
@@ skipping 369 matching lines @@
 
     return clipRect;
 }
 
 bool WebPluginContainerImpl::pluginShouldPersist() const
 {
     return m_webPlugin->shouldPersist();
 }
 
 } // namespace blink