2 files changed, 17 insertions, 1 deletions
diff --git a/content/browser/browser_plugin/browser_plugin_guest.cc b/content/browser/browser_plugin/browser_plugin_guest.cc
index 79e0dff..c43717b 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest.cc
@@ -631,9 +631,21 @@ void BrowserPluginGuest::Attach(
         ack);
     last_pending_frame_.reset();
   }
+
+  // The guest is owned by the embedder. Attach is queued up so we cannot
+  // change embedders before attach completes. If the embedder goes away,
+  // so does the guest and so we will never call WillAttachComplete because
+  // we have a weak ptr.
   delegate_->WillAttach(embedder_web_contents, browser_plugin_instance_id,
-                        params.is_full_page_plugin);
+                        params.is_full_page_plugin,
+                        base::Bind(&BrowserPluginGuest::OnWillAttachComplete,
+                                   weak_ptr_factory_.GetWeakPtr(),
+                                   embedder_web_contents, params));
+}
 
+void BrowserPluginGuest::OnWillAttachComplete(
+    WebContentsImpl* embedder_web_contents,
+    const BrowserPluginHostMsg_Attach_Params& params) {
   // If a RenderView has already been created for this new window, then we need
   // to initialize the browser-side state now so that the RenderFrameHostManager
   // does not create a new RenderView on navigation.
diff --git a/content/browser/browser_plugin/browser_plugin_guest.h b/content/browser/browser_plugin/browser_plugin_guest.h
index 946d8d9..86278b9 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.h
+++ b/content/browser/browser_plugin/browser_plugin_guest.h
@@ -339,6 +339,10 @@ class CONTENT_EXPORT BrowserPluginGuest : public GuestHost,
                          bool is_top_level,
                          const std::string& name);
 
+  // Called when WillAttach is complete.
+  void OnWillAttachComplete(WebContentsImpl* embedder_web_contents,
+                            const BrowserPluginHostMsg_Attach_Params& params);
+
   // Forwards all messages from the |pending_messages_| queue to the embedder.
   void SendQueuedMessages();