Fix a crash that the reliability bots caught.

This was a silly oops.  I had intended to call clearPluginContainer on each
WebPluginLoadObserver held in WebPluginContainerImpl's m_pluginLoadObservers
array when the WebPluginContainerImpl is destroyed, but I never hooked that up.
Here it is.

R=jam
BUG=10036
TEST=layout test: chrome/plugins/get-url-with-iframe-target-no-crash.html

Review URL: http://codereview.chromium.org/182003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@24696 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 6 insertions, 2 deletions

diff --git a/webkit/api/src/WebPluginContainerImpl.cpp b/webkit/api/src/WebPluginContainerImpl.cpp
index fb1e416..6e2dc42 100644
--- a/webkit/api/src/WebPluginContainerImpl.cpp
+++ b/webkit/api/src/WebPluginContainerImpl.cpp
@@ -255,8 +255,10 @@ void WebPluginContainerImpl::loadFrameRequest(
         // FIXME: This is a bit of hack to allow us to observe completion of
         // our frame request.  It would be better to evolve FrameLoader to
         // support a completion callback instead.
-        WebDataSourceImpl::setNextPluginLoadObserver(
-            new WebPluginLoadObserver(this, request.url(), notifyData));
+        WebPluginLoadObserver* observer =
+            new WebPluginLoadObserver(this, request.url(), notifyData);
+        m_pluginLoadObservers.append(observer);
+        WebDataSourceImpl::setNextPluginLoadObserver(observer);
     }
 
     FrameLoadRequest frameRequest(request.toResourceRequest());
@@ -312,6 +314,8 @@ void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver
 
 WebPluginContainerImpl::~WebPluginContainerImpl()
 {
+    for (size_t i = 0; i < m_pluginLoadObservers.size(); ++i)
+        m_pluginLoadObservers[i]->clearPluginContainer();
     m_webPlugin->destroy();
 }