Reverting this to see if the Flash crashes on Mac canary are due to this CL.

content/plugin/webplugin_proxy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/plugin/webplugin_proxy.h"
 
 #include "build/build_config.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_handle.h"
@@ skipping 76 matching lines @@
 #if defined(USE_X11)
   if (windowless_shm_pixmap_ != None)
     XFreePixmap(ui::GetXDisplay(), windowless_shm_pixmap_);
 #endif
 
 #if defined(OS_MACOSX)
   // Destroy the surface early, since it may send messages during cleanup.
   if (accelerated_surface_.get())
     accelerated_surface_.reset();
 #endif
-
-  if (plugin_element_)
-    WebBindings::releaseObject(plugin_element_);
-  if (window_npobject_)
-    WebBindings::releaseObject(window_npobject_);
 }
 
 bool WebPluginProxy::Send(IPC::Message* msg) {
   return channel_->Send(msg);
 }
 
 void WebPluginProxy::SetWindow(gfx::PluginWindowHandle window) {
   Send(new PluginHostMsg_SetWindow(route_id_, window));
 }
 
@@ skipping 82 matching lines @@
     // need to be painted asynchronously as per the NPAPI spec.
     MessageLoop::current()->PostTask(FROM_HERE,
         runnable_method_factory_.NewRunnableMethod(
             &WebPluginProxy::OnPaint, damaged_rect_));
     damaged_rect_ = gfx::Rect();
   }
 }
 
 NPObject* WebPluginProxy::GetWindowScriptNPObject() {
   if (window_npobject_)
-    return window_npobject_;
+    return WebBindings::retainObject(window_npobject_);
 
   int npobject_route_id = channel_->GenerateRouteID();
   bool success = false;
   Send(new PluginHostMsg_GetWindowScriptNPObject(
       route_id_, npobject_route_id, &success));
   if (!success)
     return NULL;
 
   window_npobject_ = NPObjectProxy::Create(
       channel_, npobject_route_id, containing_window_, page_url_);
 
   return window_npobject_;
 }
 
 NPObject* WebPluginProxy::GetPluginElement() {
   if (plugin_element_)
-    return plugin_element_;
+    return WebBindings::retainObject(plugin_element_);
 
   int npobject_route_id = channel_->GenerateRouteID();
   bool success = false;
   Send(new PluginHostMsg_GetPluginElement(route_id_, npobject_route_id,
                                           &success));
   if (!success)
     return NULL;
 
   plugin_element_ = NPObjectProxy::Create(
       channel_, npobject_route_id, containing_window_, page_url_);
@@ skipping 429 matching lines @@
       resource_clients_.erase(index++);
     } else {
       index++;
     }
   }
 }
 
 void WebPluginProxy::URLRedirectResponse(bool allow, int resource_id) {
   Send(new PluginHostMsg_URLRedirectResponse(route_id_, allow, resource_id));
 }