2009-04-24 Anders Carlsson <andersca@apple.com>

        Reviewed by Darin Adler.

        Fix <rdar://problem/6761635>.
        
        Make sure to keep an extra reference to the instance proxy in case the plug-in host crashes while
        we're waiting for a reply.
        
        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
        (WebKit::NetscapePluginInstanceProxy::destroy):



git-svn-id: svn://svn.chromium.org/blink/trunk@42839 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/WebKit/mac/ChangeLog

+2009-04-24  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/6761635>.
+        
+        Make sure to keep an extra reference to the instance proxy in case the plug-in host crashes while
+        we're waiting for a reply.
+        
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::destroy):
+
 2009-04-24  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Dan Bernstein

third_party/WebKit/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm

@@ -196,6 +196,10 @@ void NetscapePluginInstanceProxy::destroy()
     m_inDestroy = true;
     
     _WKPHDestroyPluginInstance(m_pluginHostProxy->port(), m_pluginID, requestID);
+ 
+    // If the plug-in host crashes while we're waiting for a reply, the last reference to the instance proxy
+    // will go away. Prevent this by protecting it here.
+    RefPtr<NetscapePluginInstanceProxy> protect(this);
     
     // We don't care about the reply here - we just want to block until the plug-in instance has been torn down.
     waitForReply<NetscapePluginInstanceProxy::BooleanReply>(requestID);