Fix WindowAndroid leak in Android WebView

WebView creates a WindowAndroid class per AwContents, but never calls
destroy on it, so the native WindowAndroid leaks. Do this in
CleanupReference of AwContents.

Also make native WindowAndroid hold a strong reference, so removes
the requirement to null check the ref, which are mostly missing anyway.

Notes:
* This adds the requirement that WindowAndroid cannot hold strong ref
  that would prevent AwContents/ContentViewCore from being gc-ed,
  which currently is the case.
* This does not address the issue that WindowAndroid should be
  per-activity, not per ContentViewCore.

BUG=469803

Review URL: https://codereview.chromium.org/1034593002

Cr-Commit-Position: refs/heads/master@{#322159}

3 files changed, 15 insertions, 13 deletions

diff --git a/android_webview/java/src/org/chromium/android_webview/AwContents.java b/android_webview/java/src/org/chromium/android_webview/AwContents.java
index 0f8974a..40a277d 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContents.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContents.java
@@ -286,12 +286,16 @@ public class AwContents implements SmartClipProvider,
 
     private static final class DestroyRunnable implements Runnable {
         private final long mNativeAwContents;
-        private DestroyRunnable(long nativeAwContents) {
+        private final WindowAndroid mWindowAndroid;
+
+        private DestroyRunnable(long nativeAwContents, WindowAndroid windowAndroid) {
             mNativeAwContents = nativeAwContents;
+            mWindowAndroid = windowAndroid;
         }
         @Override
         public void run() {
             nativeDestroy(mNativeAwContents);
+            mWindowAndroid.destroy();
         }
     }
 
@@ -863,10 +867,6 @@ public class AwContents implements SmartClipProvider,
         // each other, we should update |mBrowserContext| according to the newly received native
         // WebContent's browser context.
 
-        // The native side object has been bound to this java instance, so now is the time to
-        // bind all the native->java relationships.
-        mCleanupReference = new CleanupReference(this, new DestroyRunnable(mNativeAwContents));
-
         WebContents webContents = nativeGetWebContents(mNativeAwContents);
 
         Activity activity = ContentViewCore.activityFromContext(mContext);
@@ -884,6 +884,11 @@ public class AwContents implements SmartClipProvider,
         mSettings.setWebContents(webContents);
         nativeSetDipScale(mNativeAwContents, (float) mDIPScale);
         mContentViewCore.onShow();
+
+        // The native side object has been bound to this java instance, so now is the time to
+        // bind all the native->java relationships.
+        mCleanupReference =
+                new CleanupReference(this, new DestroyRunnable(mNativeAwContents, mWindowAndroid));
     }
 
     private void installWebContentsObserver() {
diff --git a/ui/android/window_android.cc b/ui/android/window_android.cc
index 7c920e2..066a2fe 100644
--- a/ui/android/window_android.cc
+++ b/ui/android/window_android.cc
@@ -17,8 +17,8 @@ namespace ui {
 using base::android::AttachCurrentThread;
 using base::android::ScopedJavaLocalRef;
 
-WindowAndroid::WindowAndroid(JNIEnv* env, jobject obj)
-  : weak_java_window_(env, obj), compositor_(NULL) {
+WindowAndroid::WindowAndroid(JNIEnv* env, jobject obj) : compositor_(NULL) {
+  java_window_.Reset(env, obj);
 }
 
 void WindowAndroid::Destroy(JNIEnv* env, jobject obj) {
@@ -26,7 +26,7 @@ void WindowAndroid::Destroy(JNIEnv* env, jobject obj) {
 }
 
 ScopedJavaLocalRef<jobject> WindowAndroid::GetJavaObject() {
-  return weak_java_window_.get(AttachCurrentThread());
+  return base::android::ScopedJavaLocalRef<jobject>(java_window_);
 }
 
 bool WindowAndroid::RegisterWindowAndroid(JNIEnv* env) {
@@ -77,10 +77,7 @@ void WindowAndroid::DetachCompositor() {
 
 void WindowAndroid::RequestVSyncUpdate() {
   JNIEnv* env = AttachCurrentThread();
-  ScopedJavaLocalRef<jobject> obj = GetJavaObject();
-  if (obj.is_null())
-    return;
-  Java_WindowAndroid_requestVSyncUpdate(env, obj.obj());
+  Java_WindowAndroid_requestVSyncUpdate(env, GetJavaObject().obj());
 }
 
 void WindowAndroid::SetNeedsAnimate() {
diff --git a/ui/android/window_android.h b/ui/android/window_android.h
index 73e7686..005f4d6 100644
--- a/ui/android/window_android.h
+++ b/ui/android/window_android.h
@@ -66,7 +66,7 @@ class UI_ANDROID_EXPORT WindowAndroid {
  private:
   ~WindowAndroid();
 
-  JavaObjectWeakGlobalRef weak_java_window_;
+  base::android::ScopedJavaGlobalRef<jobject> java_window_;
   gfx::Vector2dF content_offset_;
   WindowAndroidCompositor* compositor_;