Fix scripting during NPP_Destroy. Note that if the plugin is making a call to the renderer so this instance is in the callstack, destruction will have to be asynchronous and so scripting still won't work. This change also fixes use of PluginChannel after it's deleted (if this was the last instance).

BUG=23713, 23706
TEST=added ui test
Review URL: http://codereview.chromium.org/258026

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@28141 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 2 insertions, 5 deletions

diff --git a/chrome/renderer/webplugin_delegate_proxy.h b/chrome/renderer/webplugin_delegate_proxy.h
index 043bdb8..8651aabf 100644
--- a/chrome/renderer/webplugin_delegate_proxy.h
+++ b/chrome/renderer/webplugin_delegate_proxy.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -45,9 +45,6 @@ class WebPluginDelegateProxy :
   WebPluginDelegateProxy(const std::string& mime_type,
                          const base::WeakPtr<RenderView>& render_view);
 
-  // Called to drop our pointer to the window script object.
-  void DropWindowScriptObject() { window_script_object_ = NULL; }
-
   // WebPluginDelegate implementation:
   virtual void PluginDestroyed();
   virtual bool Initialize(const GURL& url,
@@ -171,7 +168,7 @@ class WebPluginDelegateProxy :
   gfx::Rect plugin_rect_;
 
   NPObject* npobject_;
-  NPObjectStub* window_script_object_;
+  base::WeakPtr<NPObjectStub> window_script_object_;
 
   // Event passed in by the plugin process and is used to decide if
   // messages need to be pumped in the NPP_HandleEvent sync call.