Add a regression test for the PluginChannel::CleanUp. My earlier speculative fix was correct.

I tracked this down to my earlier change to not leak NPObjects on channel shutdown (which now happens a lot more often because of sudden termination for tab close).  Since we now call an NPObject's deallocate function, it's possible that it leads to an NPObjectProxy being deleted, in which case we would delete an object in the listener's array while we're looping across it.

BUG=25439
Review URL: http://codereview.chromium.org/332013

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@29982 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 16 insertions, 0 deletions

diff --git a/chrome/test/ui/npapi_uitest.cc b/chrome/test/ui/npapi_uitest.cc
index 34ba3fd..4e8b26f 100644
--- a/chrome/test/ui/npapi_uitest.cc
+++ b/chrome/test/ui/npapi_uitest.cc
@@ -19,6 +19,8 @@
 #include "base/keyboard_codes.h"
 #include "chrome/browser/net/url_request_mock_http_job.h"
 #include "chrome/common/chrome_paths.h"
+#include "chrome/common/url_constants.h"
+#include "chrome/test/automation/browser_proxy.h"
 #include "chrome/test/automation/tab_proxy.h"
 #include "chrome/test/automation/window_proxy.h"
 #include "chrome/test/ui/npapi_test_helper.h"
@@ -363,3 +365,17 @@ TEST_F(NPAPITester, NoHangIfInitCrashes) {
 }
 
 #endif
+
+TEST_F(NPAPITester, NPObjectReleasedOnDestruction) {
+  if (UITest::in_process_renderer())
+    return;
+
+  GURL url = GetTestUrl(L"npapi", L"npobject_released_on_destruction.html");
+  NavigateToURL(url);
+
+  scoped_refptr<BrowserProxy> window_proxy(automation()->GetBrowserWindow(0));
+  window_proxy->AppendTab(GURL(chrome::kAboutBlankURL));
+
+  scoped_refptr<TabProxy> tab_proxy(window_proxy->GetTab(0));
+  tab_proxy->Close(true);
+}