Prevent the WebPluginContainer being destroyed inside scriptableObject()

Source/web/WebPluginContainerImpl.cpp

Index: Source/web/WebPluginContainerImpl.cpp
diff --git a/Source/web/WebPluginContainerImpl.cpp b/Source/web/WebPluginContainerImpl.cpp
index b91c1c820b0b52ab8a7def30acb784c667eb1b24..fd1e732112dbd661a7957d4e57fb5560268db0e8 100644
--- a/Source/web/WebPluginContainerImpl.cpp
+++ b/Source/web/WebPluginContainerImpl.cpp
@@ -595,11 +595,16 @@ WebLayer* WebPluginContainerImpl::platformLayer() const
 
 v8::Local<v8::Object> WebPluginContainerImpl::scriptableObject(v8::Isolate* isolate)
 {
+    // The plugin may be destroyed due to re-entrancy when calling
+    // v8ScriptableObject below. crbug.com/458776. Hold a reference to the

[sof, 2015/02/24 06:32:11]

When appropriate, could access to bug 458776 please be opened up a bit? Ditto
for 423263 -- unless there are good reasons not to, inaccessible-to-contributors
bug references in source code adds questionable value.

+    // plugin container to prevent this from happening.
+    RefPtrWillBeRawPtr<WebPluginContainerImpl> protector(this);
+
     v8::Local<v8::Object> object = m_webPlugin->v8ScriptableObject(isolate);
-    // |m_webPlugin| may be destroyed during the above line due to re-entrancy
-    // caused by sync messages to the plugin. If this is the case just return an
-    // empty handle. crbug.com/423263.
-    if (!m_webPlugin)
+
+    // If the plugin has been destroyed and the reference on the stack is the
+    // only one left, then don't return the scriptable object.
+    if (hasOneRef())

[sof, 2015/02/24 06:19:29]

Would ASSERT(!m_webPlugin) hold if there's one ref left?

         return v8::Local<v8::Object>();
 
     if (!object.IsEmpty()) {