Fix a pepper plugin process crash which occurs if we receive input events for a deleted plugin. This could happen

in the multi process plugin scenario where the renderer could send events for deleted plugins in the context of outgoing
sync calls.

Fixes bug http://code.google.com/p/flapper/issues/detail?id=87
Review URL: http://codereview.chromium.org/8073017

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@103377 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 8 insertions, 4 deletions

diff --git a/ppapi/shared_impl/resource_tracker.cc b/ppapi/shared_impl/resource_tracker.cc
index 303e980..717c038 100644
--- a/ppapi/shared_impl/resource_tracker.cc
+++ b/ppapi/shared_impl/resource_tracker.cc
@@ -144,8 +144,11 @@ PP_Resource ResourceTracker::AddResource(Resource* object) {
   if (found == instance_map_.end()) {
     // If you hit this, it's likely somebody forgot to call DidCreateInstance,
     // the resource was created with an invalid PP_Instance, or the renderer
-    // side tried to create a resource for a plugin that crashed.
-    NOTREACHED();
+    // side tried to create a resource for a plugin that crashed/exited. This
+    // could happen for OOP plugins where due to reentrancies in context of
+    // outgoing sync calls the renderer can send events after a plugin has
+    // exited.
+    DLOG(INFO) << "Failed to find plugin instance in instance map";
     return 0;
   }
 
@@ -158,8 +161,9 @@ PP_Resource ResourceTracker::AddResource(Resource* object) {
 
 void ResourceTracker::RemoveResource(Resource* object) {
   PP_Resource pp_resource = object->pp_resource();
-  if (object->pp_instance())
-    instance_map_[object->pp_instance()]->resources.erase(pp_resource);
+  InstanceMap::iterator found = instance_map_.find(object->pp_instance());
+  if (found != instance_map_.end())
+    instance_map_.erase(found);
   live_resources_.erase(pp_resource);
 }