Try to fix a crash in the var tracking.

ppapi/proxy/plugin_var_tracker.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/plugin_var_tracker.h"
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/singleton.h"
 #include "ppapi/c/dev/ppp_class_deprecated.h"
 #include "ppapi/c/ppb_var.h"
@@ skipping 135 matching lines @@
   if (found == host_var_to_plugin_var_.end()) {
     NOTREACHED();
     return;
   }
 
   // Now just release the object given the plugin var ID.
   ReleaseVar(found->second);
 }
 
 void PluginVarTracker::DidDeleteInstance(PP_Instance instance) {
+  // Calling the destructors on plugin objects may in turn release other
+  // objects which will mutate the map out from under us. So do a two-step
+  // process of identifying the ones to delete, and then delete them.
+  //
   // See the comment above user_data_to_plugin_ in the header file. We assume
   // there aren't that many objects so a brute-force search is reasonable.
-  UserDataToPluginImplementedVarMap::iterator i =
-      user_data_to_plugin_.begin();
-  while (i != user_data_to_plugin_.end()) {
-    if (i->second.instance == instance) {
-      if (!i->second.plugin_object_id) {
-        // This object is for the freed instance and the plugin is not holding
-        // any references to it. Deallocate immediately.
-        UserDataToPluginImplementedVarMap::iterator to_remove = i;
-        ++i;
-        to_remove->second.ppp_class->Deallocate(to_remove->first);
-        user_data_to_plugin_.erase(to_remove);
-      } else {
-        // The plugin is holding refs to this object. We don't want to call
-        // Deallocate since the plugin may be depending on those refs to keep
-        // its data alive. To avoid crashes in this case, just clear out the
-        // instance to mark it and continue. When the plugin refs go to 0,
-        // we'll notice there is no instance and call Deallocate.
-        i->second.instance = 0;
-        ++i;
-      }
+  std::vector<void*> user_data_to_delete;
+  for (UserDataToPluginImplementedVarMap::const_iterator i =
+           user_data_to_plugin_.begin();
+       i != user_data_to_plugin_.end();
+       ++i) {
+    if (i->second.instance == instance)
+      user_data_to_delete.push_back(i->first);
+  }
+
+  for (size_t i = 0; i < user_data_to_delete.size(); i++) {
+    UserDataToPluginImplementedVarMap::iterator found =
+        user_data_to_plugin_.find(user_data_to_delete[i]);
+    if (found == user_data_to_plugin_.end())
+      continue;  // Object removed from list while we were iterating.
+
+    if (!found->second.plugin_object_id) {
+      // This object is for the freed instance and the plugin is not holding
+      // any references to it. Deallocate immediately.
+      found->second.ppp_class->Deallocate(found->first);
+      user_data_to_plugin_.erase(found);
     } else {
-      ++i;
+      // The plugin is holding refs to this object. We don't want to call
+      // Deallocate since the plugin may be depending on those refs to keep
+      // its data alive. To avoid crashes in this case, just clear out the
+      // instance to mark it and continue. When the plugin refs go to 0,
+      // we'll notice there is no instance and call Deallocate.
+      found->second.instance = 0;
     }
   }
 }
 
 ArrayBufferVar* PluginVarTracker::CreateArrayBuffer(uint32 size_in_bytes) {
   return new PluginArrayBufferVar(size_in_bytes);
 }
 
 void PluginVarTracker::PluginImplementedObjectCreated(
     PP_Instance instance,
@@ skipping 165 matching lines @@
   VarMap::iterator ret = live_vars_.find(found->second);
   DCHECK(ret != live_vars_.end());
 
   // All objects should be proxy objects.
   DCHECK(ret->second.var->AsProxyObjectVar());
   return scoped_refptr<ProxyObjectVar>(ret->second.var->AsProxyObjectVar());
 }
 
 }  // namesace proxy
 }  // namespace ppapi