Change the PepperInProcessRouter to defer resource destruction messages.

content/renderer/pepper/pepper_in_process_router.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_in_process_router.h"
 
 #include "base/bind.h"
 #include "base/message_loop/message_loop.h"
 #include "content/public/renderer/render_thread.h"
 #include "content/public/renderer/render_view.h"
@@ skipping 92 matching lines @@
   // the message.
   if (resource)
     resource->OnReplyReceived(reply_params, nested_msg);
   return true;
 }
 
 bool PepperInProcessRouter::SendToHost(IPC::Message* msg) {
   scoped_ptr<IPC::Message> message(msg);
 
   if (!message->is_sync()) {
-    bool result = host_impl_->GetPpapiHost()->OnMessageReceived(*message);
-    DCHECK(result) << "The message was not handled by the host.";
-    return true;
+    // If this is a resource destroyed message, post a task to dispatch it.
+    // Dispatching it synchronously can cause the host to re-enter the proxy
+    // code while we're still in the resource destructor, leading to a crash.
+    // http://crbug.com/276368.
+    // This won't cause message reordering problems because the resource
+    // destroyed message is always the last one sent for a resource.
+    if (message->type() == PpapiHostMsg_ResourceDestroyed::ID) {
+      base::MessageLoop::current()->PostTask(
+          FROM_HERE,
+          base::Bind(&PepperInProcessRouter::DispatchHostMsg,
+                     weak_factory_.GetWeakPtr(),
+                     base::Owned(message.release())));
+      return true;
+    } else {
+      bool result = host_impl_->GetPpapiHost()->OnMessageReceived(*message);
+      DCHECK(result) << "The message was not handled by the host.";
+      return true;
+    }
   }
 
   pending_message_id_ = IPC::SyncMessage::GetMessageId(*message);
   reply_deserializer_.reset(
       static_cast<IPC::SyncMessage*>(message.get())->GetReplyDeserializer());
   reply_result_ = false;
 
   bool result = host_impl_->GetPpapiHost()->OnMessageReceived(*message);
   DCHECK(result) << "The message was not handled by the host.";
 
@@ skipping 13 matching lines @@
     // Dispatch plugin messages from the message loop.
     base::MessageLoop::current()->PostTask(
         FROM_HERE,
         base::Bind(&PepperInProcessRouter::DispatchPluginMsg,
                    weak_factory_.GetWeakPtr(),
                    base::Owned(message.release())));
   }
   return true;
 }
 
+void PepperInProcessRouter::DispatchHostMsg(IPC::Message* msg) {
+  bool handled = host_impl_->GetPpapiHost()->OnMessageReceived(*msg);
+  DCHECK(handled);
+}
+
 void PepperInProcessRouter::DispatchPluginMsg(IPC::Message* msg) {
   bool handled = OnPluginMsgReceived(*msg);
   DCHECK(handled);
 }
 
 bool PepperInProcessRouter::SendToBrowser(IPC::Message *msg) {
   return RenderThread::Get()->Send(msg);
 }
 
 }  // namespace content