7 files changed, 29 insertions, 6 deletions
diff --git a/content/browser/renderer_host/pepper/browser_ppapi_host_impl.cc b/content/browser/renderer_host/pepper/browser_ppapi_host_impl.cc
index d039c70..5f3cdfe 100644
--- a/content/browser/renderer_host/pepper/browser_ppapi_host_impl.cc
+++ b/content/browser/renderer_host/pepper/browser_ppapi_host_impl.cc
@@ -49,22 +49,27 @@ BrowserPpapiHostImpl::BrowserPpapiHostImpl(
     const ppapi::PpapiPermissions& permissions,
     const std::string& plugin_name,
     const FilePath& profile_data_directory)
-    : ppapi_host_(sender, permissions),
+    : ppapi_host_(new ppapi::host::PpapiHost(sender, permissions)),
       plugin_process_handle_(base::kNullProcessHandle),
       plugin_name_(plugin_name),
       profile_data_directory_(profile_data_directory) {
-  message_filter_ = new HostMessageFilter(&ppapi_host_);
-  ppapi_host_.AddHostFactoryFilter(scoped_ptr<ppapi::host::HostFactory>(
+  message_filter_ = new HostMessageFilter(ppapi_host_.get());
+  ppapi_host_->AddHostFactoryFilter(scoped_ptr<ppapi::host::HostFactory>(
       new ContentBrowserPepperHostFactory(this)));
 }
 
 BrowserPpapiHostImpl::~BrowserPpapiHostImpl() {
   // Notify the filter so it won't foward messages to us.
   message_filter_->OnHostDestroyed();
+
+  // Delete the host explicitly first. This shutdown will destroy the
+  // resources, which may want to do cleanup in their destructors and expect
+  // their pointers to us to be valid.
+  ppapi_host_.reset();
 }
 
 ppapi::host::PpapiHost* BrowserPpapiHostImpl::GetPpapiHost() {
-  return &ppapi_host_;
+  return ppapi_host_.get();
 }
 
 base::ProcessHandle BrowserPpapiHostImpl::GetPluginProcessHandle() const {
diff --git a/content/browser/renderer_host/pepper/browser_ppapi_host_impl.h b/content/browser/renderer_host/pepper/browser_ppapi_host_impl.h
index ce3560e..1af0228 100644
--- a/content/browser/renderer_host/pepper/browser_ppapi_host_impl.h
+++ b/content/browser/renderer_host/pepper/browser_ppapi_host_impl.h
@@ -80,7 +80,7 @@ class CONTENT_EXPORT BrowserPpapiHostImpl : public BrowserPpapiHost {
     ppapi::host::PpapiHost* ppapi_host_;
   };
 
-  ppapi::host::PpapiHost ppapi_host_;
+  scoped_ptr<ppapi::host::PpapiHost> ppapi_host_;
   base::ProcessHandle plugin_process_handle_;
   std::string plugin_name_;
   FilePath profile_data_directory_;
diff --git a/content/public/renderer/renderer_ppapi_host.h b/content/public/renderer/renderer_ppapi_host.h
index e9e1cbf..f8a1432 100644
--- a/content/public/renderer/renderer_ppapi_host.h
+++ b/content/public/renderer/renderer_ppapi_host.h
@@ -82,7 +82,8 @@ class RendererPpapiHost {
   virtual bool IsValidInstance(PP_Instance instance) const = 0;
 
   // Returns the PluginInstance for the given PP_Instance, or NULL if the
-  // PP_Instance is invalid.
+  // PP_Instance is invalid (the common case this will be invalid is during
+  // plugin teardown when resource hosts are being force-freed).
   virtual webkit::ppapi::PluginInstance* GetPluginInstance(
       PP_Instance instance) const = 0;
 
diff --git a/content/renderer/pepper/renderer_ppapi_host_impl.cc b/content/renderer/pepper/renderer_ppapi_host_impl.cc
index 5724770..c573c97 100644
--- a/content/renderer/pepper/renderer_ppapi_host_impl.cc
+++ b/content/renderer/pepper/renderer_ppapi_host_impl.cc
@@ -91,6 +91,10 @@ RendererPpapiHostImpl::RendererPpapiHostImpl(
 }
 
 RendererPpapiHostImpl::~RendererPpapiHostImpl() {
+  // Delete the host explicitly first. This shutdown will destroy the
+  // resources, which may want to do cleanup in their destructors and expect
+  // their pointers to us to be valid.
+  ppapi_host_.reset();
 }
 
 // static
diff --git a/ppapi/host/ppapi_host.cc b/ppapi/host/ppapi_host.cc
index afb8396..87dfb11 100644
--- a/ppapi/host/ppapi_host.cc
+++ b/ppapi/host/ppapi_host.cc
@@ -37,6 +37,10 @@ PpapiHost::~PpapiHost() {
   // technically alive in case one of the filters accesses us from the
   // destructor.
   instance_message_filters_.clear();
+
+  // The resources may also want to use us in their destructors.
+  resources_.clear();
+  pending_resource_hosts_.clear();
 }
 
 bool PpapiHost::Send(IPC::Message* msg) {
diff --git a/webkit/plugins/ppapi/plugin_module.cc b/webkit/plugins/ppapi/plugin_module.cc
index 046140d..74c8942 100644
--- a/webkit/plugins/ppapi/plugin_module.cc
+++ b/webkit/plugins/ppapi/plugin_module.cc
@@ -431,6 +431,10 @@ PluginModule::~PluginModule() {
   // holding a reference to us.
   DCHECK(instances_.empty());
 
+  // Some resources and other stuff are hung off of the embedder state, which
+  // should be torn down before the routing stuff below.
+  embedder_state_.reset();
+
   GetLivePluginSet()->erase(this);
 
   callback_tracker_->AbortAll();
diff --git a/webkit/plugins/ppapi/ppapi_plugin_instance.cc b/webkit/plugins/ppapi/ppapi_plugin_instance.cc
index 053b603..c326528 100644
--- a/webkit/plugins/ppapi/ppapi_plugin_instance.cc
+++ b/webkit/plugins/ppapi/ppapi_plugin_instance.cc
@@ -405,6 +405,11 @@ PluginInstance::PluginInstance(
 PluginInstance::~PluginInstance() {
   DCHECK(!fullscreen_container_);
 
+  // Force-unbind any Graphics. In the case of Graphics2D, if the plugin
+  // leaks the graphics 2D, it may actually get cleaned up after our
+  // destruction, so we need its pointers to be up-to-date.
+  BindGraphics(pp_instance(), 0);
+
   // Free all the plugin objects. This will automatically clear the back-
   // pointer from the NPObject so WebKit can't call into the plugin any more.
   //