This fixes http://b/issue?id=1303133, which was a crash

in the renderer due to the plugin instance getting destroyed
in the context of the ShowModalHTMLDialog request. The fix
is to convert the WebPluginDelegateProxy object in a DeleteLater and to set its channel to NULL in the destructor. This ensures that the reply to the message can be sent out successfully.

Bug=1303133



git-svn-id: svn://svn.chromium.org/chrome/trunk/src@286 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 5 insertions, 3 deletions

diff --git a/chrome/renderer/webplugin_delegate_proxy.cc b/chrome/renderer/webplugin_delegate_proxy.cc
index 0dc1436..5f60f69 100644
--- a/chrome/renderer/webplugin_delegate_proxy.cc
+++ b/chrome/renderer/webplugin_delegate_proxy.cc
@@ -199,10 +199,9 @@ void WebPluginDelegateProxy::PluginDestroyed() {
 
     channel_host_->RemoveRoute(instance_id_);
     Send(new PluginMsg_DestroyInstance(instance_id_));
-    channel_host_ = NULL;
   }
   render_view_->PluginDestroyed(this);
-  delete this;
+  MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 void WebPluginDelegateProxy::FlushGeometryUpdates() {
diff --git a/chrome/renderer/webplugin_delegate_proxy.h b/chrome/renderer/webplugin_delegate_proxy.h
index b13cc76..dbb4e6e 100644
--- a/chrome/renderer/webplugin_delegate_proxy.h
+++ b/chrome/renderer/webplugin_delegate_proxy.h
@@ -113,11 +113,14 @@ class WebPluginDelegateProxy : public WebPluginDelegate,
   virtual void URLRequestRouted(const std::string&url, bool notify_needed,
                                 void* notify_data);
 
+ protected:
+  template<class WebPluginDelegateProxy> friend class DeleteTask;
+  ~WebPluginDelegateProxy();
+
  private:
   WebPluginDelegateProxy(const std::string& mime_type,
                          const std::string& clsid,
                          RenderView* render_view);
-  ~WebPluginDelegateProxy();
 
   // Message handlers for messages that proxy WebPlugin methods, which
   // we translate into calls to the real WebPlugin.