Pass RenderFrameHost to WebContentObservers' message handlers

This patch enables WebContentsObserver::OnMessageReceived to receive
a reference to RenderFrameHost that received the message.

This allows passing of JavaBridgeDispatcherHostManager ownership from
WebContentsImpl to ContentViewCore and removing of some redundant
initialization code in JavaBridgeDispatcherHostManager, fixing
a long-standing TODO.

Review URL: https://codereview.chromium.org/253013002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@268939 0039d316-1c4b-4281-b951-d872f2087c98

19 files changed, 151 insertions, 109 deletions

diff --git a/chrome/browser/content_settings/tab_specific_content_settings.cc b/chrome/browser/content_settings/tab_specific_content_settings.cc
index f6d0ee7..7de878d 100644
--- a/chrome/browser/content_settings/tab_specific_content_settings.cc
+++ b/chrome/browser/content_settings/tab_specific_content_settings.cc
@@ -639,7 +639,8 @@ void TabSpecificContentSettings::RenderFrameForInterstitialPageCreated(
 }
 
 bool TabSpecificContentSettings::OnMessageReceived(
-    const IPC::Message& message) {
+    const IPC::Message& message,
+    content::RenderFrameHost* render_frame_host) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(TabSpecificContentSettings, message)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_ContentBlocked, OnContentBlocked)
diff --git a/chrome/browser/content_settings/tab_specific_content_settings.h b/chrome/browser/content_settings/tab_specific_content_settings.h
index 665110c..063faa9 100644
--- a/chrome/browser/content_settings/tab_specific_content_settings.h
+++ b/chrome/browser/content_settings/tab_specific_content_settings.h
@@ -283,7 +283,9 @@ class TabSpecificContentSettings
   // content::WebContentsObserver overrides.
   virtual void RenderFrameForInterstitialPageCreated(
       content::RenderFrameHost* render_frame_host) OVERRIDE;
-  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
+  virtual bool OnMessageReceived(
+      const IPC::Message& message,
+      content::RenderFrameHost* render_frame_host) OVERRIDE;
   virtual void DidNavigateMainFrame(
       const content::LoadCommittedDetails& details,
       const content::FrameNavigateParams& params) OVERRIDE;
diff --git a/chrome/browser/guest_view/web_view/plugin_permission_helper.cc b/chrome/browser/guest_view/web_view/plugin_permission_helper.cc
index 12bcc7d..1ff179e 100644
--- a/chrome/browser/guest_view/web_view/plugin_permission_helper.cc
+++ b/chrome/browser/guest_view/web_view/plugin_permission_helper.cc
@@ -26,16 +26,26 @@ PluginPermissionHelper::PluginPermissionHelper(WebContents* contents)
 PluginPermissionHelper::~PluginPermissionHelper() {
 }
 
-bool PluginPermissionHelper::OnMessageReceived(const IPC::Message& message) {
+bool PluginPermissionHelper::OnMessageReceived(
+    const IPC::Message& message,
+    content::RenderFrameHost* render_frame_host) {
   IPC_BEGIN_MESSAGE_MAP(PluginPermissionHelper, message)
-    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedUnauthorizedPlugin,
-                        OnBlockedUnauthorizedPlugin)
-    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_CouldNotLoadPlugin,
-                        OnCouldNotLoadPlugin)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedOutdatedPlugin,
                         OnBlockedOutdatedPlugin)
+    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedUnauthorizedPlugin,
+                        OnBlockedUnauthorizedPlugin)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_NPAPINotSupported,
                         OnNPAPINotSupported)
+    IPC_MESSAGE_UNHANDLED(return false)
+  IPC_END_MESSAGE_MAP()
+
+  return true;
+}
+
+bool PluginPermissionHelper::OnMessageReceived(const IPC::Message& message) {
+  IPC_BEGIN_MESSAGE_MAP(PluginPermissionHelper, message)
+    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_CouldNotLoadPlugin,
+                        OnCouldNotLoadPlugin)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_OpenAboutPlugins,
                         OnOpenAboutPlugins)
 #if defined(ENABLE_PLUGIN_INSTALLATION)
diff --git a/chrome/browser/guest_view/web_view/plugin_permission_helper.h b/chrome/browser/guest_view/web_view/plugin_permission_helper.h
index e937bc3..93ecabd 100644
--- a/chrome/browser/guest_view/web_view/plugin_permission_helper.h
+++ b/chrome/browser/guest_view/web_view/plugin_permission_helper.h
@@ -20,6 +20,9 @@ class PluginPermissionHelper
   friend class content::WebContentsUserData<PluginPermissionHelper>;
 
   // content::WebContentsObserver implementation.
+  virtual bool OnMessageReceived(
+      const IPC::Message& message,
+      content::RenderFrameHost* render_frame_host) OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
   // Message handlers:
diff --git a/chrome/browser/plugins/plugin_observer.cc b/chrome/browser/plugins/plugin_observer.cc
index 4312062..a77b093 100644
--- a/chrome/browser/plugins/plugin_observer.cc
+++ b/chrome/browser/plugins/plugin_observer.cc
@@ -329,12 +329,25 @@ void PluginObserver::PluginCrashed(const base::FilePath& plugin_path,
       infobar_text);
 }
 
-bool PluginObserver::OnMessageReceived(const IPC::Message& message) {
+bool PluginObserver::OnMessageReceived(
+      const IPC::Message& message,
+      content::RenderFrameHost* render_frame_host) {
   IPC_BEGIN_MESSAGE_MAP(PluginObserver, message)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedOutdatedPlugin,
                         OnBlockedOutdatedPlugin)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedUnauthorizedPlugin,
                         OnBlockedUnauthorizedPlugin)
+    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_NPAPINotSupported,
+                        OnNPAPINotSupported)
+
+    IPC_MESSAGE_UNHANDLED(return false)
+  IPC_END_MESSAGE_MAP()
+
+  return true;
+}
+
+bool PluginObserver::OnMessageReceived(const IPC::Message& message) {
+  IPC_BEGIN_MESSAGE_MAP(PluginObserver, message)
 #if defined(ENABLE_PLUGIN_INSTALLATION)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_FindMissingPlugin,
                         OnFindMissingPlugin)
@@ -345,8 +358,6 @@ bool PluginObserver::OnMessageReceived(const IPC::Message& message) {
                         OnOpenAboutPlugins)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_CouldNotLoadPlugin,
                         OnCouldNotLoadPlugin)
-    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_NPAPINotSupported,
-                        OnNPAPINotSupported)
 
     IPC_MESSAGE_UNHANDLED(return false)
   IPC_END_MESSAGE_MAP()
diff --git a/chrome/browser/plugins/plugin_observer.h b/chrome/browser/plugins/plugin_observer.h
index 868eb3b..306dd1c 100644
--- a/chrome/browser/plugins/plugin_observer.h
+++ b/chrome/browser/plugins/plugin_observer.h
@@ -41,6 +41,9 @@ class PluginObserver : public content::WebContentsObserver,
       content::RenderFrameHost* render_frame_host) OVERRIDE;
   virtual void PluginCrashed(const base::FilePath& plugin_path,
                              base::ProcessId plugin_pid) OVERRIDE;
+  virtual bool OnMessageReceived(
+      const IPC::Message& message,
+      content::RenderFrameHost* render_frame_host) OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
  private:
diff --git a/content/browser/android/content_view_core_impl.cc b/content/browser/android/content_view_core_impl.cc
index 5dcbb66..9206763 100644
--- a/content/browser/android/content_view_core_impl.cc
+++ b/content/browser/android/content_view_core_impl.cc
@@ -210,11 +210,13 @@ ContentViewCore* ContentViewCore::GetNativeContentViewCore(JNIEnv* env,
       Java_ContentViewCore_getNativeContentViewCore(env, obj));
 }
 
-ContentViewCoreImpl::ContentViewCoreImpl(JNIEnv* env,
-                                         jobject obj,
-                                         WebContents* web_contents,
-                                         ui::ViewAndroid* view_android,
-                                         ui::WindowAndroid* window_android)
+ContentViewCoreImpl::ContentViewCoreImpl(
+    JNIEnv* env,
+    jobject obj,
+    WebContents* web_contents,
+    ui::ViewAndroid* view_android,
+    ui::WindowAndroid* window_android,
+    jobject java_bridge_retained_object_set)
     : WebContentsObserver(web_contents),
       java_ref_(env, obj),
       web_contents_(static_cast<WebContentsImpl*>(web_contents)),
@@ -244,6 +246,10 @@ ContentViewCoreImpl::ContentViewCoreImpl(JNIEnv* env,
       BuildUserAgentFromOSAndProduct(kLinuxInfoStr, product);
   web_contents->SetUserAgentOverride(spoofed_ua);
 
+  java_bridge_dispatcher_host_manager_.reset(
+      new JavaBridgeDispatcherHostManager(web_contents,
+                                          java_bridge_retained_object_set));
+
   InitWebContents();
 }
 
@@ -1275,8 +1281,7 @@ void ContentViewCoreImpl::SetAllowJavascriptInterfacesInspection(
     JNIEnv* env,
     jobject obj,
     jboolean allow) {
-  web_contents_->java_bridge_dispatcher_host_manager()
-      ->SetAllowObjectContentsInspection(allow);
+  java_bridge_dispatcher_host_manager_->SetAllowObjectContentsInspection(allow);
 }
 
 void ContentViewCoreImpl::AddJavascriptInterface(
@@ -1284,31 +1289,26 @@ void ContentViewCoreImpl::AddJavascriptInterface(
     jobject /* obj */,
     jobject object,
     jstring name,
-    jclass safe_annotation_clazz,
-    jobject retained_object_set) {
+    jclass safe_annotation_clazz) {
   ScopedJavaLocalRef<jobject> scoped_object(env, object);
   ScopedJavaLocalRef<jclass> scoped_clazz(env, safe_annotation_clazz);
-  JavaObjectWeakGlobalRef weak_retained_object_set(env, retained_object_set);
 
   // JavaBoundObject creates the NPObject with a ref count of 1, and
   // JavaBridgeDispatcherHostManager takes its own ref.
-  JavaBridgeDispatcherHostManager* java_bridge =
-      web_contents_->java_bridge_dispatcher_host_manager();
-  java_bridge->SetRetainedObjectSet(weak_retained_object_set);
-  NPObject* bound_object =
-      JavaBoundObject::Create(scoped_object,
-                              scoped_clazz,
-                              java_bridge->AsWeakPtr(),
-                              java_bridge->GetAllowObjectContentsInspection());
-  java_bridge->AddNamedObject(ConvertJavaStringToUTF16(env, name),
-                              bound_object);
+  NPObject* bound_object = JavaBoundObject::Create(
+      scoped_object,
+      scoped_clazz,
+      java_bridge_dispatcher_host_manager_->AsWeakPtr(),
+      java_bridge_dispatcher_host_manager_->GetAllowObjectContentsInspection());
+  java_bridge_dispatcher_host_manager_->AddNamedObject(
+      ConvertJavaStringToUTF16(env, name), bound_object);
   blink::WebBindings::releaseObject(bound_object);
 }
 
 void ContentViewCoreImpl::RemoveJavascriptInterface(JNIEnv* env,
                                                     jobject /* obj */,
                                                     jstring name) {
-  web_contents_->java_bridge_dispatcher_host_manager()->RemoveNamedObject(
+  java_bridge_dispatcher_host_manager_->RemoveNamedObject(
       ConvertJavaStringToUTF16(env, name));
 }
 
@@ -1680,12 +1680,14 @@ jlong Init(JNIEnv* env,
            jobject obj,
            jlong native_web_contents,
            jlong view_android,
-           jlong window_android) {
+           jlong window_android,
+           jobject retained_objects_set) {
   ContentViewCoreImpl* view = new ContentViewCoreImpl(
       env, obj,
       reinterpret_cast<WebContents*>(native_web_contents),
       reinterpret_cast<ui::ViewAndroid*>(view_android),
-      reinterpret_cast<ui::WindowAndroid*>(window_android));
+      reinterpret_cast<ui::WindowAndroid*>(window_android),
+      retained_objects_set);
   return reinterpret_cast<intptr_t>(view);
 }
 
diff --git a/content/browser/android/content_view_core_impl.h b/content/browser/android/content_view_core_impl.h
index 07e2dd1..95e6e85 100644
--- a/content/browser/android/content_view_core_impl.h
+++ b/content/browser/android/content_view_core_impl.h
@@ -31,6 +31,7 @@ class WindowAndroid;
 }
 
 namespace content {
+class JavaBridgeDispatcherHostManager;
 class RenderWidgetHostViewAndroid;
 struct MenuItem;
 
@@ -44,7 +45,8 @@ class ContentViewCoreImpl : public ContentViewCore,
                       jobject obj,
                       WebContents* web_contents,
                       ui::ViewAndroid* view_android,
-                      ui::WindowAndroid* window_android);
+                      ui::WindowAndroid* window_android,
+                      jobject java_bridge_retained_object_set);
 
   // ContentViewCore implementation.
   virtual base::android::ScopedJavaLocalRef<jobject> GetJavaObject() OVERRIDE;
@@ -184,8 +186,7 @@ class ContentViewCoreImpl : public ContentViewCore,
                               jobject obj,
                               jobject object,
                               jstring name,
-                              jclass safe_annotation_clazz,
-                              jobject retained_object_set);
+                              jclass safe_annotation_clazz);
   void RemoveJavascriptInterface(JNIEnv* env, jobject obj, jstring name);
   int GetNavigationHistory(JNIEnv* env, jobject obj, jobject history);
   void GetDirectedNavigationHistory(JNIEnv* env,
@@ -374,6 +375,10 @@ class ContentViewCoreImpl : public ContentViewCore,
 
   bool geolocation_needs_pause_;
 
+  // Manages injecting Java objects.
+  scoped_ptr<JavaBridgeDispatcherHostManager>
+      java_bridge_dispatcher_host_manager_;
+
   DISALLOW_COPY_AND_ASSIGN(ContentViewCoreImpl);
 };
 
diff --git a/content/browser/frame_host/interstitial_page_impl.cc b/content/browser/frame_host/interstitial_page_impl.cc
index 184a561..44c5876 100644
--- a/content/browser/frame_host/interstitial_page_impl.cc
+++ b/content/browser/frame_host/interstitial_page_impl.cc
@@ -371,6 +371,12 @@ void InterstitialPageImpl::WebContentsDestroyed(WebContents* web_contents) {
   OnNavigatingAwayOrTabClosing();
 }
 
+bool InterstitialPageImpl::OnMessageReceived(
+    const IPC::Message& message,
+    RenderFrameHost* render_frame_host) {
+  return OnMessageReceived(message);
+}
+
 bool InterstitialPageImpl::OnMessageReceived(RenderFrameHost* render_frame_host,
                                              const IPC::Message& message) {
   return OnMessageReceived(message);
diff --git a/content/browser/frame_host/interstitial_page_impl.h b/content/browser/frame_host/interstitial_page_impl.h
index 8cb1419..73a3855 100644
--- a/content/browser/frame_host/interstitial_page_impl.h
+++ b/content/browser/frame_host/interstitial_page_impl.h
@@ -108,6 +108,8 @@ class CONTENT_EXPORT InterstitialPageImpl
                        const NotificationDetails& details) OVERRIDE;
 
   // WebContentsObserver implementation:
+  virtual bool OnMessageReceived(const IPC::Message& message,
+                                 RenderFrameHost* render_frame_host) OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
   virtual void WebContentsDestroyed(WebContents* web_contents) OVERRIDE;
   virtual void NavigationEntryCommitted(
diff --git a/content/browser/renderer_host/java/java_bridge_dispatcher_host.h b/content/browser/renderer_host/java/java_bridge_dispatcher_host.h
index b62ea82..a656f07 100644
--- a/content/browser/renderer_host/java/java_bridge_dispatcher_host.h
+++ b/content/browser/renderer_host/java/java_bridge_dispatcher_host.h
@@ -49,13 +49,12 @@ class JavaBridgeDispatcherHost
   void RenderFrameDeleted();
 
   void OnGetChannelHandle(IPC::Message* reply_msg);
+  void Send(IPC::Message* msg);
 
  private:
   friend class base::RefCountedThreadSafe<JavaBridgeDispatcherHost>;
   virtual ~JavaBridgeDispatcherHost();
 
-  void Send(IPC::Message* msg);
-
   void GetChannelHandle(IPC::Message* reply_msg);
   void CreateNPVariantParam(NPObject* object, NPVariant_Param* param);
   void CreateObjectStub(NPObject* object, int render_process_id, int route_id);
diff --git a/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.cc b/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.cc
index 8d587bd..635a1d1 100644
--- a/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.cc
+++ b/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.cc
@@ -13,6 +13,7 @@
 #include "content/browser/renderer_host/java/java_bound_object.h"
 #include "content/browser/renderer_host/java/java_bridge_dispatcher_host.h"
 #include "content/common/android/hash_set.h"
+#include "content/common/java_bridge_messages.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "third_party/WebKit/public/web/WebBindings.h"
@@ -20,9 +21,13 @@
 namespace content {
 
 JavaBridgeDispatcherHostManager::JavaBridgeDispatcherHostManager(
-    WebContents* web_contents)
+    WebContents* web_contents,
+    jobject retained_object_set)
     : WebContentsObserver(web_contents),
+      retained_object_set_(base::android::AttachCurrentThread(),
+                           retained_object_set),
       allow_object_contents_inspection_(true) {
+  DCHECK(retained_object_set);
 }
 
 JavaBridgeDispatcherHostManager::~JavaBridgeDispatcherHostManager() {
@@ -48,27 +53,6 @@ void JavaBridgeDispatcherHostManager::AddNamedObject(const base::string16& name,
   }
 }
 
-void JavaBridgeDispatcherHostManager::SetRetainedObjectSet(
-    const JavaObjectWeakGlobalRef& retained_object_set) {
-  // It's an error to replace the retained_object_set_ after it's been set,
-  // so we check that it hasn't already been here.
-  // TODO(benm): It'd be better to pass the set in the constructor to avoid
-  // the chance of this happening; but that's tricky as this get's constructed
-  // before ContentViewCore (which owns the set). Best solution may be to move
-  // ownership of the JavaBridgerDispatchHostManager from WebContents to
-  // ContentViewCore?
-  JNIEnv* env = base::android::AttachCurrentThread();
-  base::android::ScopedJavaLocalRef<jobject> new_retained_object_set =
-      retained_object_set.get(env);
-  base::android::ScopedJavaLocalRef<jobject> current_retained_object_set =
-      retained_object_set_.get(env);
-  if (!env->IsSameObject(new_retained_object_set.obj(),
-                         current_retained_object_set.obj())) {
-    DCHECK(current_retained_object_set.is_null());
-    retained_object_set_ = retained_object_set;
-  }
-}
-
 void JavaBridgeDispatcherHostManager::RemoveNamedObject(
     const base::string16& name) {
   ObjectMap::iterator iter = objects_.find(name);
@@ -85,11 +69,6 @@ void JavaBridgeDispatcherHostManager::RemoveNamedObject(
   }
 }
 
-void JavaBridgeDispatcherHostManager::OnGetChannelHandle(
-    RenderFrameHost* render_frame_host, IPC::Message* reply_msg) {
-  instances_[render_frame_host]->OnGetChannelHandle(reply_msg);
-}
-
 void JavaBridgeDispatcherHostManager::RenderFrameCreated(
     RenderFrameHost* render_frame_host) {
   // Creates a JavaBridgeDispatcherHost for the specified RenderViewHost and
@@ -132,6 +111,25 @@ void JavaBridgeDispatcherHostManager::DocumentAvailableInMainFrame() {
   }
 }
 
+bool JavaBridgeDispatcherHostManager::OnMessageReceived(
+    const IPC::Message& message,
+    RenderFrameHost* render_frame_host) {
+  DCHECK(render_frame_host);
+  if (!instances_.count(render_frame_host))
+    return false;
+  scoped_refptr<JavaBridgeDispatcherHost> instance =
+      instances_[render_frame_host];
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(JavaBridgeDispatcherHostManager, message)
+    IPC_MESSAGE_FORWARD_DELAY_REPLY(
+        JavaBridgeHostMsg_GetChannelHandle,
+        instance.get(),
+        JavaBridgeDispatcherHost::OnGetChannelHandle)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  return handled;
+}
+
 void JavaBridgeDispatcherHostManager::JavaBoundObjectCreated(
     const base::android::JavaRef<jobject>& object) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
diff --git a/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h b/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h
index 3ada0d0..8d03576 100644
--- a/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h
+++ b/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h
@@ -28,7 +28,8 @@ class JavaBridgeDispatcherHostManager
     : public WebContentsObserver,
       public base::SupportsWeakPtr<JavaBridgeDispatcherHostManager> {
  public:
-  explicit JavaBridgeDispatcherHostManager(WebContents* web_contents);
+  JavaBridgeDispatcherHostManager(WebContents* web_contents,
+                                  jobject retained_object_set);
   virtual ~JavaBridgeDispatcherHostManager();
 
   // These methods add or remove the object to each JavaBridgeDispatcherHost.
@@ -37,21 +38,12 @@ class JavaBridgeDispatcherHostManager
   void AddNamedObject(const base::string16& name, NPObject* object);
   void RemoveNamedObject(const base::string16& name);
 
-  void OnGetChannelHandle(RenderFrameHost* render_frame_host,
-                          IPC::Message* reply_msg);
-
-  // Every time a JavaBoundObject backed by a real Java object is
-  // created/destroyed, we insert/remove a strong ref to that Java object into
-  // this set so that it doesn't get garbage collected while it's still
-  // potentially in use. Although the set is managed native side, it's owned
-  // and defined in Java so that pushing refs into it does not create new GC
-  // roots that would prevent ContentViewCore from being garbage collected.
-  void SetRetainedObjectSet(const JavaObjectWeakGlobalRef& retained_object_set);
-
   // WebContentsObserver overrides
   virtual void RenderFrameCreated(RenderFrameHost* render_frame_host) OVERRIDE;
   virtual void RenderFrameDeleted(RenderFrameHost* render_frame_host) OVERRIDE;
   virtual void DocumentAvailableInMainFrame() OVERRIDE;
+  virtual bool OnMessageReceived(const IPC::Message& message,
+                                 RenderFrameHost* render_frame_host) OVERRIDE;
 
   void JavaBoundObjectCreated(const base::android::JavaRef<jobject>& object);
   void JavaBoundObjectDestroyed(const base::android::JavaRef<jobject>& object);
@@ -67,6 +59,12 @@ class JavaBridgeDispatcherHostManager
   InstanceMap instances_;
   typedef std::map<base::string16, NPObject*> ObjectMap;
   ObjectMap objects_;
+  // Every time a JavaBoundObject backed by a real Java object is
+  // created/destroyed, we insert/remove a strong ref to that Java object into
+  // this set so that it doesn't get garbage collected while it's still
+  // potentially in use. Although the set is managed native side, it's owned
+  // and defined in Java so that pushing refs into it does not create new GC
+  // roots that would prevent ContentViewCore from being garbage collected.
   JavaObjectWeakGlobalRef retained_object_set_;
   bool allow_object_contents_inspection_;
 
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index ea872a6..47871dc 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -96,9 +96,7 @@
 #if defined(OS_ANDROID)
 #include "content/browser/android/date_time_chooser_android.h"
 #include "content/browser/media/android/browser_media_player_manager.h"
-#include "content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h"
 #include "content/browser/web_contents/web_contents_android.h"
-#include "content/common/java_bridge_messages.h"
 #include "content/public/browser/android/content_view_core.h"
 #endif
 
@@ -481,9 +479,15 @@ bool WebContentsImpl::OnMessageReceived(RenderViewHost* render_view_host,
 
   ObserverListBase<WebContentsObserver>::Iterator it(observers_);
   WebContentsObserver* observer;
-  while ((observer = it.GetNext()) != NULL)
-    if (observer->OnMessageReceived(message))
-      return true;
+  if (render_frame_host) {
+    while ((observer = it.GetNext()) != NULL)
+      if (observer->OnMessageReceived(message, render_frame_host))
+        return true;
+  } else {
+    while ((observer = it.GetNext()) != NULL)
+      if (observer->OnMessageReceived(message))
+        return true;
+  }
 
   // Message handlers should be aware of which
   // RenderViewHost/RenderFrameHost sent the message, which is temporarily
@@ -553,8 +557,6 @@ bool WebContentsImpl::OnMessageReceived(RenderViewHost* render_view_host,
                         OnFindMatchRectsReply)
     IPC_MESSAGE_HANDLER(ViewHostMsg_OpenDateTimeDialog,
                         OnOpenDateTimeDialog)
-    IPC_MESSAGE_HANDLER_DELAY_REPLY(JavaBridgeHostMsg_GetChannelHandle,
-                                    OnJavaBridgeGetChannelHandle)
 #endif
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP_EX()
@@ -1099,8 +1101,6 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
                  NOTIFICATION_RENDER_WIDGET_HOST_DESTROYED,
                  NotificationService::AllBrowserContextsAndSources());
 #if defined(OS_ANDROID)
-  java_bridge_dispatcher_host_manager_.reset(
-      new JavaBridgeDispatcherHostManager(this));
   date_time_chooser_.reset(new DateTimeChooserAndroid());
 #endif
 }
@@ -2705,11 +2705,6 @@ void WebContentsImpl::OnOpenDateTimeDialog(
                                  value.suggestions);
 }
 
-void WebContentsImpl::OnJavaBridgeGetChannelHandle(IPC::Message* reply_msg) {
-  java_bridge_dispatcher_host_manager_->OnGetChannelHandle(
-      render_frame_message_source_, reply_msg);
-}
-
 #endif
 
 void WebContentsImpl::OnPepperPluginHung(int plugin_child_id,
diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index 92c8fea..93563b0 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h
@@ -49,7 +49,6 @@ class BrowserPluginGuestManager;
 class DateTimeChooserAndroid;
 class DownloadItem;
 class InterstitialPageImpl;
-class JavaBridgeDispatcherHostManager;
 class JavaScriptDialogManager;
 class PowerSaveBlocker;
 class RenderViewHost;
@@ -120,10 +119,6 @@ class CONTENT_EXPORT WebContentsImpl
   SavePackage* save_package() const { return save_package_.get(); }
 
 #if defined(OS_ANDROID)
-  JavaBridgeDispatcherHostManager* java_bridge_dispatcher_host_manager() const {
-    return java_bridge_dispatcher_host_manager_.get();
-  }
-
   // In Android WebView, the RenderView needs created even there is no
   // navigation entry, this allows Android WebViews to use
   // javascript: URLs that load into the DOMWindow before the first page
@@ -732,7 +727,6 @@ class CONTENT_EXPORT WebContentsImpl
 
   void OnOpenDateTimeDialog(
       const ViewHostMsg_DateTimeDialogValue_Params& value);
-  void OnJavaBridgeGetChannelHandle(IPC::Message* reply_msg);
 #endif
   void OnPepperPluginHung(int plugin_child_id,
                           const base::FilePath& path,
@@ -927,13 +921,6 @@ class CONTENT_EXPORT WebContentsImpl
   // Manages the frame tree of the page and process swaps in each node.
   FrameTree frame_tree_;
 
-#if defined(OS_ANDROID)
-  // Manages injecting Java objects into all RenderViewHosts associated with
-  // this WebContentsImpl.
-  scoped_ptr<JavaBridgeDispatcherHostManager>
-      java_bridge_dispatcher_host_manager_;
-#endif
-
   // SavePackage, lazily created.
   scoped_refptr<SavePackage> save_package_;
 
diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
index e8ad655..62f9f4a 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
@@ -609,7 +609,8 @@ public class ContentViewCore
         };
 
         mNativeContentViewCore = nativeInit(
-                nativeWebContents, viewAndroidNativePointer, windowNativePointer);
+                nativeWebContents, viewAndroidNativePointer, windowNativePointer,
+                mRetainedJavaScriptObjects);
         mWebContents = nativeGetWebContentsAndroid(mNativeContentViewCore);
         mContentSettings = new ContentSettings(this, mNativeContentViewCore);
         initializeContainerView(internalDispatcher);
@@ -2702,8 +2703,7 @@ public class ContentViewCore
             Class<? extends Annotation> requiredAnnotation) {
         if (mNativeContentViewCore != 0 && object != null) {
             mJavaScriptInterfaces.put(name, object);
-            nativeAddJavascriptInterface(mNativeContentViewCore, object, name, requiredAnnotation,
-                    mRetainedJavaScriptObjects);
+            nativeAddJavascriptInterface(mNativeContentViewCore, object, name, requiredAnnotation);
         }
     }
 
@@ -3082,7 +3082,7 @@ public class ContentViewCore
     }
 
     private native long nativeInit(long webContentsPtr,
-            long viewAndroidPtr, long windowAndroidPtr);
+            long viewAndroidPtr, long windowAndroidPtr, HashSet<Object> retainedObjectSet);
 
     @CalledByNative
     private ContentVideoViewClient getContentVideoViewClient() {
@@ -3236,7 +3236,7 @@ public class ContentViewCore
             long nativeContentViewCoreImpl, boolean allow);
 
     private native void nativeAddJavascriptInterface(long nativeContentViewCoreImpl, Object object,
-            String name, Class requiredAnnotation, HashSet<Object> retainedObjectSet);
+            String name, Class requiredAnnotation);
 
     private native void nativeRemoveJavascriptInterface(long nativeContentViewCoreImpl,
             String name);
diff --git a/content/public/browser/web_contents_observer.cc b/content/public/browser/web_contents_observer.cc
index fc0fcf2..48fb25a 100644
--- a/content/public/browser/web_contents_observer.cc
+++ b/content/public/browser/web_contents_observer.cc
@@ -41,6 +41,12 @@ void WebContentsObserver::Observe(WebContents* web_contents) {
   }
 }
 
+bool WebContentsObserver::OnMessageReceived(
+    const IPC::Message& message,
+    RenderFrameHost* render_frame_host) {
+  return false;
+}
+
 bool WebContentsObserver::OnMessageReceived(const IPC::Message& message) {
   return false;
 }
diff --git a/content/public/browser/web_contents_observer.h b/content/public/browser/web_contents_observer.h
index e0ee3b9..1ebb463 100644
--- a/content/public/browser/web_contents_observer.h
+++ b/content/public/browser/web_contents_observer.h
@@ -331,6 +331,10 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   virtual void AccessibilityEventReceived(
       const std::vector<AXEventNotificationDetails>& details) {}
 
+  // Invoked if an IPC message is coming from a specific RenderFrameHost.
+  virtual bool OnMessageReceived(const IPC::Message& message,
+                                 RenderFrameHost* render_frame_host);
+
   // IPC::Listener implementation.
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
diff --git a/extensions/browser/extension_function.cc b/extensions/browser/extension_function.cc
index 470ae55..270f907 100644
--- a/extensions/browser/extension_function.cc
+++ b/extensions/browser/extension_function.cc
@@ -130,6 +130,16 @@ class UIThreadExtensionFunction::RenderHostTracker
     function_->SetRenderFrameHost(NULL);
   }
 
+  virtual bool OnMessageReceived(
+      const IPC::Message& message,
+      content::RenderFrameHost* render_frame_host) OVERRIDE {
+    DCHECK(render_frame_host);
+    if (render_frame_host == function_->render_frame_host())
+      return function_->OnMessageReceived(message);
+    else
+      return false;
+  }
+
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE {
     return function_->OnMessageReceived(message);
   }