Add a NULL channel check in CreateNPVariantParam as it can be called with

a NULL channel during renderer plugin shutdown.

Fixes bug http://code.google.com/p/chromium/issues/detail?id=4740

R=jam
Bug=4740

Review URL: http://codereview.chromium.org/12609

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@5943 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 15 insertions, 9 deletions

diff --git a/chrome/plugin/npobject_util.cc b/chrome/plugin/npobject_util.cc
index 092e9fc..8936471 100644
--- a/chrome/plugin/npobject_util.cc
+++ b/chrome/plugin/npobject_util.cc
@@ -171,15 +171,21 @@ void CreateNPVariantParam(const NPVariant& variant,
         // Don't release, because our original variant is the same as our proxy.
         release = false;
       } else {
-        // NPObjectStub adds its own reference to the NPObject it owns, so if we
-        // were supposed to release the corresponding variant (release==true),
-        // we should still do that.
-        param->type = NPVARIANT_PARAM_OBJECT_ROUTING_ID;
-        int route_id = channel->GenerateRouteID();
-        NPObjectStub* object_stub = new NPObjectStub(
-            variant.value.objectValue, channel, route_id);
-        param->npobject_routing_id = route_id;
-        param->npobject_pointer = variant.value.objectValue;
+        // The channel could be NULL if there was a channel error. The caller's
+        // Send call will fail anyways.
+        if (channel) {
+          // NPObjectStub adds its own reference to the NPObject it owns, so if
+          // we were supposed to release the corresponding variant
+          // (release==true), we should still do that.
+          param->type = NPVARIANT_PARAM_OBJECT_ROUTING_ID;
+          int route_id = channel->GenerateRouteID();
+          NPObjectStub* object_stub = new NPObjectStub(
+              variant.value.objectValue, channel, route_id);
+          param->npobject_routing_id = route_id;
+          param->npobject_pointer = variant.value.objectValue;
+        } else {
+          param->type = NPVARIANT_PARAM_VOID;
+        }
       }
       break;
     }