Fixed a crash and added a test to find it.

BUG=46526
TEST=Run test_shell_tests.exe
Review URL: http://codereview.chromium.org/2817005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@49877 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 14 insertions, 8 deletions

diff --git a/webkit/glue/plugins/plugin_lib.cc b/webkit/glue/plugins/plugin_lib.cc
index c335b51..d3ae50e 100644
--- a/webkit/glue/plugins/plugin_lib.cc
+++ b/webkit/glue/plugins/plugin_lib.cc
@@ -43,11 +43,17 @@ PluginLib* PluginLib::CreatePluginLib(const FilePath& filename) {
 
 void PluginLib::UnloadAllPlugins() {
   if (g_loaded_libs) {
-    for (size_t i = 0; i < g_loaded_libs->size(); ++i)
-      (*g_loaded_libs)[i]->Unload();
-
-    delete g_loaded_libs;
-    g_loaded_libs = NULL;
+    // PluginLib::Unload() can remove items from the list and even delete
+    // the list when it removes the last item, so we must work with a copy
+    // of the list so that we don't get the carpet removed under our feet.
+    std::vector<scoped_refptr<PluginLib> > loaded_libs(*g_loaded_libs);
+    for (size_t i = 0; i < loaded_libs.size(); ++i)
+      loaded_libs[i]->Unload();
+
+    if (g_loaded_libs && g_loaded_libs->empty()) {
+      delete g_loaded_libs;
+      g_loaded_libs = NULL;
+    }
   }
 }
 
@@ -68,7 +74,7 @@ PluginLib::PluginLib(const WebPluginInfo& info,
       skip_unload_(false),
       always_loaded_(false) {
   StatsCounter(kPluginLibrariesLoadedCounter).Increment();
-  memset((void*)&plugin_funcs_, 0, sizeof(plugin_funcs_));
+  memset(static_cast<void*>(&plugin_funcs_), 0, sizeof(plugin_funcs_));
   g_loaded_libs->push_back(this);
 
   if (entry_points) {
@@ -142,7 +148,7 @@ PluginInstance* PluginLib::CreateInstance(const std::string& mime_type) {
   PluginInstance* new_instance = new PluginInstance(this, mime_type);
   instance_count_++;
   StatsCounter(kPluginInstancesActiveCounter).Increment();
-  DCHECK(new_instance != 0);
+  DCHECK_NE(static_cast<PluginInstance*>(NULL), new_instance);
   return new_instance;
 }
 
@@ -277,7 +283,7 @@ void PluginLib::Unload() {
         base::UnloadNativeLibrary(library_);
     }
 
-    library_ = 0;
+    library_ = NULL;
   }
 
   for (size_t i = 0; i < g_loaded_libs->size(); ++i) {