1 files changed, 10 insertions, 8 deletions

diff --git a/Source/WebKit2/UIProcess/WebContext.cpp b/Source/WebKit2/UIProcess/WebContext.cpp
index 6987405be..d2f18070e 100644
--- a/Source/WebKit2/UIProcess/WebContext.cpp
+++ b/Source/WebKit2/UIProcess/WebContext.cpp
@@ -612,20 +612,20 @@ void WebContext::addVisitedLinkHash(LinkHash linkHash)
     m_visitedLinkProvider.addVisitedLink(linkHash);
 }
 
-void WebContext::sendDidGetPlugins(uint64_t requestID, const Vector<PluginInfo>& pluginInfos)
+void WebContext::sendDidGetPlugins(uint64_t requestID, PassOwnPtr<Vector<PluginInfo> > pluginInfos)
 {
     ASSERT(isMainThread());
 
-    Vector<PluginInfo> plugins(pluginInfos);
+    OwnPtr<Vector<PluginInfo> > plugins(pluginInfos);
 
 #if PLATFORM(MAC)
     // Add built-in PDF last, so that it's not used when a real plug-in is installed.
     // NOTE: This has to be done on the main thread as it calls localizedString().
     if (!omitPDFSupport())
-        plugins.append(BuiltInPDFView::pluginInfo());
+        plugins->append(BuiltInPDFView::pluginInfo());
 #endif
 
-    process()->send(Messages::WebProcess::DidGetPlugins(requestID, plugins), 0);
+    process()->send(Messages::WebProcess::DidGetPlugins(requestID, *plugins), 0);
 }
 
 void WebContext::handleGetPlugins(uint64_t requestID, bool refresh)
@@ -633,13 +633,15 @@ void WebContext::handleGetPlugins(uint64_t requestID, bool refresh)
     if (refresh)
         m_pluginInfoStore.refresh();
 
-    Vector<PluginInfo> pluginInfos;
+    OwnPtr<Vector<PluginInfo> > pluginInfos = adoptPtr(new Vector<PluginInfo>);
 
     Vector<PluginModuleInfo> plugins = m_pluginInfoStore.plugins();
     for (size_t i = 0; i < plugins.size(); ++i)
-        pluginInfos.append(plugins[i].info);
+        pluginInfos->append(plugins[i].info);
 
-    RunLoop::main()->dispatch(bind(&WebContext::sendDidGetPlugins, this, requestID, pluginInfos));
+    // NOTE: We have to pass the PluginInfo vector to the secondary thread via a pointer as otherwise
+    //       we'd end up with a deref() race on all the WTF::Strings it contains.
+    RunLoop::main()->dispatch(bind(&WebContext::sendDidGetPlugins, this, requestID, pluginInfos.release()));
 }
 
 void WebContext::getPlugins(CoreIPC::Connection*, uint64_t requestID, bool refresh)
@@ -653,11 +655,11 @@ void WebContext::getPluginPath(const String& mimeType, const String& urlString,
 
     String newMimeType = mimeType.lower();
 
+    blocked = false;
     PluginModuleInfo plugin = pluginInfoStore().findPlugin(newMimeType, KURL(KURL(), urlString));
     if (!plugin.path)
         return;
 
-    blocked = false;
     if (pluginInfoStore().shouldBlockPlugin(plugin)) {
         blocked = true;
         return;