Keep the module in scope when executing scripts. This prevents a crash when the

script deletes the plugin object synchronously. This in turn deletes the
dispatcher which will make the code returning the out param and exception to
the plugin crash.

To prevent the crash, this patch adds a way for the proxy to manipulate the
refcount of the plugin object so that it's still alive when as long as the
scripting message is being processed.

A manual test is included. This is not automatically run now. I tried to fit it
into the current test infrastructure and found it very challenging, We need to
revisit this to allow custom tests to more easily be written.

TEST=manual with included plugin and html
BUG=none
Review URL: http://codereview.chromium.org/6881012

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@81993 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 17 insertions, 0 deletions

diff --git a/ppapi/proxy/host_dispatcher.h b/ppapi/proxy/host_dispatcher.h
index ea676d1..2391308 100644
--- a/ppapi/proxy/host_dispatcher.h
+++ b/ppapi/proxy/host_dispatcher.h
@@ -128,6 +128,23 @@ class HostDispatcher : public Dispatcher {
   DISALLOW_COPY_AND_ASSIGN(HostDispatcher);
 };
 
+// Create this object on the stack to prevent the module (and hence the
+// dispatcher) from being deleted out from under you. This is necessary when
+// calling some scripting functions that may delete the plugin.
+//
+// This may only be called in the host. The parameter is a plain Dispatcher
+// since that's what most callers have.
+class ScopedModuleReference {
+ public:
+  ScopedModuleReference(Dispatcher* dispatcher);
+  ~ScopedModuleReference();
+
+ private:
+  HostDispatcher* dispatcher_;
+
+  DISALLOW_COPY_AND_ASSIGN(ScopedModuleReference);
+};
+
 }  // namespace proxy
 }  // namespace pp