2 files changed, 21 insertions, 27 deletions
diff --git a/content/browser/plugin_process_host.cc b/content/browser/plugin_process_host.cc
index f71fa73..9ec7510 100644
--- a/content/browser/plugin_process_host.cc
+++ b/content/browser/plugin_process_host.cc
@@ -405,39 +405,29 @@ void PluginProcessHost::OnChannelCreated(
   Client* client = sent_requests_.front();
 
   if (client) {
-    resource_context_map_[client->ID()] = client->GetResourceContext();
+    if (!resource_context_map_.count(client->ID())) {
+      ResourceContextEntry entry;
+      entry.ref_count = 0;
+      entry.resource_context = client->GetResourceContext();
+      resource_context_map_[client->ID()] = entry;
+    }
+    resource_context_map_[client->ID()].ref_count++;
     client->OnChannelOpened(channel_handle);
   }
   sent_requests_.pop_front();
 }
 
 void PluginProcessHost::OnChannelDestroyed(int renderer_id) {
-  resource_context_map_.erase(renderer_id);
-  removed_pids_.insert(renderer_id);
+  resource_context_map_[renderer_id].ref_count--;
+  if (!resource_context_map_[renderer_id].ref_count)
+    resource_context_map_.erase(renderer_id);
 }
 
 void PluginProcessHost::GetContexts(const ResourceHostMsg_Request& request,
                                     ResourceContext** resource_context,
                                     net::URLRequestContext** request_context) {
-  *resource_context = resource_context_map_[request.origin_pid];
-  if (!*resource_context) {
-    std::string url = request.first_party_for_cookies.spec();
-    // Debugging http://crbug.com/302530
-    url += std::string("_") + base::IntToString(request.origin_pid);
-
-    for (std::map<int, ResourceContext*>::iterator i =
-            resource_context_map_.begin();
-         i != resource_context_map_.end(); ++i) {
-      url += std::string("_") + base::IntToString(i->first);
-    }
-
-    url += "_";
-    for (std::set<int>::iterator i = removed_pids_.begin();
-         i != removed_pids_.end(); ++i) {
-      url += std::string("_") + base::IntToString(*i);
-    }
-    GetContentClient()->SetActiveURL(GURL(url));
-  }
+  *resource_context =
+      resource_context_map_[request.origin_pid].resource_context;
   *request_context = (*resource_context)->GetRequestContext();
 }
 
diff --git a/content/browser/plugin_process_host.h b/content/browser/plugin_process_host.h
index e58c8d2..aaaf6dd 100644
--- a/content/browser/plugin_process_host.h
+++ b/content/browser/plugin_process_host.h
@@ -182,13 +182,17 @@ class CONTENT_EXPORT PluginProcessHost : public BrowserChildProcessHostDelegate,
   bool plugin_cursor_visible_;
 #endif
 
-  // Map from render_process_id to its ResourceContext
-  typedef std::map<int, ResourceContext*> ResourceContextMap;
+  // Map from render_process_id to its ResourceContext. Instead of storing the
+  // raw pointer, we store the struct below. This is needed because a renderer
+  // process can actually have multiple IPC channels to the same plugin process,
+  // depending on timing conditions with plugin instance creation and shutdown.
+  struct ResourceContextEntry {
+    ResourceContext* resource_context;
+    int ref_count;
+  };
+  typedef std::map<int, ResourceContextEntry> ResourceContextMap;
   ResourceContextMap resource_context_map_;
 
-  // Debugging http://crbug.com/302530
-  std::set<int> removed_pids_;
-
   scoped_ptr<BrowserChildProcessHostImpl> process_;
 
   DISALLOW_COPY_AND_ASSIGN(PluginProcessHost);