Revert 268939 "Pass RenderFrameHost to WebContentObservers' mess..."

Win and linux bots are failing. See crbug.com/371030 for more details.
Reverting to see if this CL is part of the cause.

> Pass RenderFrameHost to WebContentObservers' message handlers
> 
> This patch enables WebContentsObserver::OnMessageReceived to receive
> a reference to RenderFrameHost that received the message.
> 
> This allows passing of JavaBridgeDispatcherHostManager ownership from
> WebContentsImpl to ContentViewCore and removing of some redundant
> initialization code in JavaBridgeDispatcherHostManager, fixing
> a long-standing TODO.
> 
> Review URL: https://codereview.chromium.org/253013002

TBR=mnaganov@chromium.org

Review URL: https://codereview.chromium.org/271863005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@269075 0039d316-1c4b-4281-b951-d872f2087c98

19 files changed, 109 insertions, 151 deletions

diff --git a/chrome/browser/content_settings/tab_specific_content_settings.cc b/chrome/browser/content_settings/tab_specific_content_settings.cc
index 7de878d..f6d0ee7 100644
--- a/chrome/browser/content_settings/tab_specific_content_settings.cc
+++ b/chrome/browser/content_settings/tab_specific_content_settings.cc
@@ -639,8 +639,7 @@ void TabSpecificContentSettings::RenderFrameForInterstitialPageCreated(
 }
 
 bool TabSpecificContentSettings::OnMessageReceived(
-    const IPC::Message& message,
-    content::RenderFrameHost* render_frame_host) {
+    const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(TabSpecificContentSettings, message)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_ContentBlocked, OnContentBlocked)
diff --git a/chrome/browser/content_settings/tab_specific_content_settings.h b/chrome/browser/content_settings/tab_specific_content_settings.h
index 063faa9..665110c 100644
--- a/chrome/browser/content_settings/tab_specific_content_settings.h
+++ b/chrome/browser/content_settings/tab_specific_content_settings.h
@@ -283,9 +283,7 @@ class TabSpecificContentSettings
   // content::WebContentsObserver overrides.
   virtual void RenderFrameForInterstitialPageCreated(
       content::RenderFrameHost* render_frame_host) OVERRIDE;
-  virtual bool OnMessageReceived(
-      const IPC::Message& message,
-      content::RenderFrameHost* render_frame_host) OVERRIDE;
+  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
   virtual void DidNavigateMainFrame(
       const content::LoadCommittedDetails& details,
       const content::FrameNavigateParams& params) OVERRIDE;
diff --git a/chrome/browser/guest_view/web_view/plugin_permission_helper.cc b/chrome/browser/guest_view/web_view/plugin_permission_helper.cc
index 1ff179e..12bcc7d 100644
--- a/chrome/browser/guest_view/web_view/plugin_permission_helper.cc
+++ b/chrome/browser/guest_view/web_view/plugin_permission_helper.cc
@@ -26,26 +26,16 @@ PluginPermissionHelper::PluginPermissionHelper(WebContents* contents)
 PluginPermissionHelper::~PluginPermissionHelper() {
 }
 
-bool PluginPermissionHelper::OnMessageReceived(
-    const IPC::Message& message,
-    content::RenderFrameHost* render_frame_host) {
+bool PluginPermissionHelper::OnMessageReceived(const IPC::Message& message) {
   IPC_BEGIN_MESSAGE_MAP(PluginPermissionHelper, message)
-    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedOutdatedPlugin,
-                        OnBlockedOutdatedPlugin)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedUnauthorizedPlugin,
                         OnBlockedUnauthorizedPlugin)
-    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_NPAPINotSupported,
-                        OnNPAPINotSupported)
-    IPC_MESSAGE_UNHANDLED(return false)
-  IPC_END_MESSAGE_MAP()
-
-  return true;
-}
-
-bool PluginPermissionHelper::OnMessageReceived(const IPC::Message& message) {
-  IPC_BEGIN_MESSAGE_MAP(PluginPermissionHelper, message)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_CouldNotLoadPlugin,
                         OnCouldNotLoadPlugin)
+    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedOutdatedPlugin,
+                        OnBlockedOutdatedPlugin)
+    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_NPAPINotSupported,
+                        OnNPAPINotSupported)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_OpenAboutPlugins,
                         OnOpenAboutPlugins)
 #if defined(ENABLE_PLUGIN_INSTALLATION)
diff --git a/chrome/browser/guest_view/web_view/plugin_permission_helper.h b/chrome/browser/guest_view/web_view/plugin_permission_helper.h
index 93ecabd..e937bc3 100644
--- a/chrome/browser/guest_view/web_view/plugin_permission_helper.h
+++ b/chrome/browser/guest_view/web_view/plugin_permission_helper.h
@@ -20,9 +20,6 @@ class PluginPermissionHelper
   friend class content::WebContentsUserData<PluginPermissionHelper>;
 
   // content::WebContentsObserver implementation.
-  virtual bool OnMessageReceived(
-      const IPC::Message& message,
-      content::RenderFrameHost* render_frame_host) OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
   // Message handlers:
diff --git a/chrome/browser/plugins/plugin_observer.cc b/chrome/browser/plugins/plugin_observer.cc
index a77b093..4312062 100644
--- a/chrome/browser/plugins/plugin_observer.cc
+++ b/chrome/browser/plugins/plugin_observer.cc
@@ -329,25 +329,12 @@ void PluginObserver::PluginCrashed(const base::FilePath& plugin_path,
       infobar_text);
 }
 
-bool PluginObserver::OnMessageReceived(
-      const IPC::Message& message,
-      content::RenderFrameHost* render_frame_host) {
+bool PluginObserver::OnMessageReceived(const IPC::Message& message) {
   IPC_BEGIN_MESSAGE_MAP(PluginObserver, message)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedOutdatedPlugin,
                         OnBlockedOutdatedPlugin)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedUnauthorizedPlugin,
                         OnBlockedUnauthorizedPlugin)
-    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_NPAPINotSupported,
-                        OnNPAPINotSupported)
-
-    IPC_MESSAGE_UNHANDLED(return false)
-  IPC_END_MESSAGE_MAP()
-
-  return true;
-}
-
-bool PluginObserver::OnMessageReceived(const IPC::Message& message) {
-  IPC_BEGIN_MESSAGE_MAP(PluginObserver, message)
 #if defined(ENABLE_PLUGIN_INSTALLATION)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_FindMissingPlugin,
                         OnFindMissingPlugin)
@@ -358,6 +345,8 @@ bool PluginObserver::OnMessageReceived(const IPC::Message& message) {
                         OnOpenAboutPlugins)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_CouldNotLoadPlugin,
                         OnCouldNotLoadPlugin)
+    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_NPAPINotSupported,
+                        OnNPAPINotSupported)
 
     IPC_MESSAGE_UNHANDLED(return false)
   IPC_END_MESSAGE_MAP()
diff --git a/chrome/browser/plugins/plugin_observer.h b/chrome/browser/plugins/plugin_observer.h
index 306dd1c..868eb3b 100644
--- a/chrome/browser/plugins/plugin_observer.h
+++ b/chrome/browser/plugins/plugin_observer.h
@@ -41,9 +41,6 @@ class PluginObserver : public content::WebContentsObserver,
       content::RenderFrameHost* render_frame_host) OVERRIDE;
   virtual void PluginCrashed(const base::FilePath& plugin_path,
                              base::ProcessId plugin_pid) OVERRIDE;
-  virtual bool OnMessageReceived(
-      const IPC::Message& message,
-      content::RenderFrameHost* render_frame_host) OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
  private:
diff --git a/content/browser/android/content_view_core_impl.cc b/content/browser/android/content_view_core_impl.cc
index 9206763..5dcbb66 100644
--- a/content/browser/android/content_view_core_impl.cc
+++ b/content/browser/android/content_view_core_impl.cc
@@ -210,13 +210,11 @@ ContentViewCore* ContentViewCore::GetNativeContentViewCore(JNIEnv* env,
       Java_ContentViewCore_getNativeContentViewCore(env, obj));
 }
 
-ContentViewCoreImpl::ContentViewCoreImpl(
-    JNIEnv* env,
-    jobject obj,
-    WebContents* web_contents,
-    ui::ViewAndroid* view_android,
-    ui::WindowAndroid* window_android,
-    jobject java_bridge_retained_object_set)
+ContentViewCoreImpl::ContentViewCoreImpl(JNIEnv* env,
+                                         jobject obj,
+                                         WebContents* web_contents,
+                                         ui::ViewAndroid* view_android,
+                                         ui::WindowAndroid* window_android)
     : WebContentsObserver(web_contents),
       java_ref_(env, obj),
       web_contents_(static_cast<WebContentsImpl*>(web_contents)),
@@ -246,10 +244,6 @@ ContentViewCoreImpl::ContentViewCoreImpl(
       BuildUserAgentFromOSAndProduct(kLinuxInfoStr, product);
   web_contents->SetUserAgentOverride(spoofed_ua);
 
-  java_bridge_dispatcher_host_manager_.reset(
-      new JavaBridgeDispatcherHostManager(web_contents,
-                                          java_bridge_retained_object_set));
-
   InitWebContents();
 }
 
@@ -1281,7 +1275,8 @@ void ContentViewCoreImpl::SetAllowJavascriptInterfacesInspection(
     JNIEnv* env,
     jobject obj,
     jboolean allow) {
-  java_bridge_dispatcher_host_manager_->SetAllowObjectContentsInspection(allow);
+  web_contents_->java_bridge_dispatcher_host_manager()
+      ->SetAllowObjectContentsInspection(allow);
 }
 
 void ContentViewCoreImpl::AddJavascriptInterface(
@@ -1289,26 +1284,31 @@ void ContentViewCoreImpl::AddJavascriptInterface(
     jobject /* obj */,
     jobject object,
     jstring name,
-    jclass safe_annotation_clazz) {
+    jclass safe_annotation_clazz,
+    jobject retained_object_set) {
   ScopedJavaLocalRef<jobject> scoped_object(env, object);
   ScopedJavaLocalRef<jclass> scoped_clazz(env, safe_annotation_clazz);
+  JavaObjectWeakGlobalRef weak_retained_object_set(env, retained_object_set);
 
   // JavaBoundObject creates the NPObject with a ref count of 1, and
   // JavaBridgeDispatcherHostManager takes its own ref.
-  NPObject* bound_object = JavaBoundObject::Create(
-      scoped_object,
-      scoped_clazz,
-      java_bridge_dispatcher_host_manager_->AsWeakPtr(),
-      java_bridge_dispatcher_host_manager_->GetAllowObjectContentsInspection());
-  java_bridge_dispatcher_host_manager_->AddNamedObject(
-      ConvertJavaStringToUTF16(env, name), bound_object);
+  JavaBridgeDispatcherHostManager* java_bridge =
+      web_contents_->java_bridge_dispatcher_host_manager();
+  java_bridge->SetRetainedObjectSet(weak_retained_object_set);
+  NPObject* bound_object =
+      JavaBoundObject::Create(scoped_object,
+                              scoped_clazz,
+                              java_bridge->AsWeakPtr(),
+                              java_bridge->GetAllowObjectContentsInspection());
+  java_bridge->AddNamedObject(ConvertJavaStringToUTF16(env, name),
+                              bound_object);
   blink::WebBindings::releaseObject(bound_object);
 }
 
 void ContentViewCoreImpl::RemoveJavascriptInterface(JNIEnv* env,
                                                     jobject /* obj */,
                                                     jstring name) {
-  java_bridge_dispatcher_host_manager_->RemoveNamedObject(
+  web_contents_->java_bridge_dispatcher_host_manager()->RemoveNamedObject(
       ConvertJavaStringToUTF16(env, name));
 }
 
@@ -1680,14 +1680,12 @@ jlong Init(JNIEnv* env,
            jobject obj,
            jlong native_web_contents,
            jlong view_android,
-           jlong window_android,
-           jobject retained_objects_set) {
+           jlong window_android) {
   ContentViewCoreImpl* view = new ContentViewCoreImpl(
       env, obj,
       reinterpret_cast<WebContents*>(native_web_contents),
       reinterpret_cast<ui::ViewAndroid*>(view_android),
-      reinterpret_cast<ui::WindowAndroid*>(window_android),
-      retained_objects_set);
+      reinterpret_cast<ui::WindowAndroid*>(window_android));
   return reinterpret_cast<intptr_t>(view);
 }
 
diff --git a/content/browser/android/content_view_core_impl.h b/content/browser/android/content_view_core_impl.h
index 95e6e85..07e2dd1 100644
--- a/content/browser/android/content_view_core_impl.h
+++ b/content/browser/android/content_view_core_impl.h
@@ -31,7 +31,6 @@ class WindowAndroid;
 }
 
 namespace content {
-class JavaBridgeDispatcherHostManager;
 class RenderWidgetHostViewAndroid;
 struct MenuItem;
 
@@ -45,8 +44,7 @@ class ContentViewCoreImpl : public ContentViewCore,
                       jobject obj,
                       WebContents* web_contents,
                       ui::ViewAndroid* view_android,
-                      ui::WindowAndroid* window_android,
-                      jobject java_bridge_retained_object_set);
+                      ui::WindowAndroid* window_android);
 
   // ContentViewCore implementation.
   virtual base::android::ScopedJavaLocalRef<jobject> GetJavaObject() OVERRIDE;
@@ -186,7 +184,8 @@ class ContentViewCoreImpl : public ContentViewCore,
                               jobject obj,
                               jobject object,
                               jstring name,
-                              jclass safe_annotation_clazz);
+                              jclass safe_annotation_clazz,
+                              jobject retained_object_set);
   void RemoveJavascriptInterface(JNIEnv* env, jobject obj, jstring name);
   int GetNavigationHistory(JNIEnv* env, jobject obj, jobject history);
   void GetDirectedNavigationHistory(JNIEnv* env,
@@ -375,10 +374,6 @@ class ContentViewCoreImpl : public ContentViewCore,
 
   bool geolocation_needs_pause_;
 
-  // Manages injecting Java objects.
-  scoped_ptr<JavaBridgeDispatcherHostManager>
-      java_bridge_dispatcher_host_manager_;
-
   DISALLOW_COPY_AND_ASSIGN(ContentViewCoreImpl);
 };
 
diff --git a/content/browser/frame_host/interstitial_page_impl.cc b/content/browser/frame_host/interstitial_page_impl.cc
index 44c5876..184a561 100644
--- a/content/browser/frame_host/interstitial_page_impl.cc
+++ b/content/browser/frame_host/interstitial_page_impl.cc
@@ -371,12 +371,6 @@ void InterstitialPageImpl::WebContentsDestroyed(WebContents* web_contents) {
   OnNavigatingAwayOrTabClosing();
 }
 
-bool InterstitialPageImpl::OnMessageReceived(
-    const IPC::Message& message,
-    RenderFrameHost* render_frame_host) {
-  return OnMessageReceived(message);
-}
-
 bool InterstitialPageImpl::OnMessageReceived(RenderFrameHost* render_frame_host,
                                              const IPC::Message& message) {
   return OnMessageReceived(message);
diff --git a/content/browser/frame_host/interstitial_page_impl.h b/content/browser/frame_host/interstitial_page_impl.h
index 73a3855..8cb1419 100644
--- a/content/browser/frame_host/interstitial_page_impl.h
+++ b/content/browser/frame_host/interstitial_page_impl.h
@@ -108,8 +108,6 @@ class CONTENT_EXPORT InterstitialPageImpl
                        const NotificationDetails& details) OVERRIDE;
 
   // WebContentsObserver implementation:
-  virtual bool OnMessageReceived(const IPC::Message& message,
-                                 RenderFrameHost* render_frame_host) OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
   virtual void WebContentsDestroyed(WebContents* web_contents) OVERRIDE;
   virtual void NavigationEntryCommitted(
diff --git a/content/browser/renderer_host/java/java_bridge_dispatcher_host.h b/content/browser/renderer_host/java/java_bridge_dispatcher_host.h
index a656f07..b62ea82 100644
--- a/content/browser/renderer_host/java/java_bridge_dispatcher_host.h
+++ b/content/browser/renderer_host/java/java_bridge_dispatcher_host.h
@@ -49,12 +49,13 @@ class JavaBridgeDispatcherHost
   void RenderFrameDeleted();
 
   void OnGetChannelHandle(IPC::Message* reply_msg);
-  void Send(IPC::Message* msg);
 
  private:
   friend class base::RefCountedThreadSafe<JavaBridgeDispatcherHost>;
   virtual ~JavaBridgeDispatcherHost();
 
+  void Send(IPC::Message* msg);
+
   void GetChannelHandle(IPC::Message* reply_msg);
   void CreateNPVariantParam(NPObject* object, NPVariant_Param* param);
   void CreateObjectStub(NPObject* object, int render_process_id, int route_id);
diff --git a/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.cc b/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.cc
index 635a1d1..8d587bd 100644
--- a/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.cc
+++ b/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.cc
@@ -13,7 +13,6 @@
 #include "content/browser/renderer_host/java/java_bound_object.h"
 #include "content/browser/renderer_host/java/java_bridge_dispatcher_host.h"
 #include "content/common/android/hash_set.h"
-#include "content/common/java_bridge_messages.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "third_party/WebKit/public/web/WebBindings.h"
@@ -21,13 +20,9 @@
 namespace content {
 
 JavaBridgeDispatcherHostManager::JavaBridgeDispatcherHostManager(
-    WebContents* web_contents,
-    jobject retained_object_set)
+    WebContents* web_contents)
     : WebContentsObserver(web_contents),
-      retained_object_set_(base::android::AttachCurrentThread(),
-                           retained_object_set),
       allow_object_contents_inspection_(true) {
-  DCHECK(retained_object_set);
 }
 
 JavaBridgeDispatcherHostManager::~JavaBridgeDispatcherHostManager() {
@@ -53,6 +48,27 @@ void JavaBridgeDispatcherHostManager::AddNamedObject(const base::string16& name,
   }
 }
 
+void JavaBridgeDispatcherHostManager::SetRetainedObjectSet(
+    const JavaObjectWeakGlobalRef& retained_object_set) {
+  // It's an error to replace the retained_object_set_ after it's been set,
+  // so we check that it hasn't already been here.
+  // TODO(benm): It'd be better to pass the set in the constructor to avoid
+  // the chance of this happening; but that's tricky as this get's constructed
+  // before ContentViewCore (which owns the set). Best solution may be to move
+  // ownership of the JavaBridgerDispatchHostManager from WebContents to
+  // ContentViewCore?
+  JNIEnv* env = base::android::AttachCurrentThread();
+  base::android::ScopedJavaLocalRef<jobject> new_retained_object_set =
+      retained_object_set.get(env);
+  base::android::ScopedJavaLocalRef<jobject> current_retained_object_set =
+      retained_object_set_.get(env);
+  if (!env->IsSameObject(new_retained_object_set.obj(),
+                         current_retained_object_set.obj())) {
+    DCHECK(current_retained_object_set.is_null());
+    retained_object_set_ = retained_object_set;
+  }
+}
+
 void JavaBridgeDispatcherHostManager::RemoveNamedObject(
     const base::string16& name) {
   ObjectMap::iterator iter = objects_.find(name);
@@ -69,6 +85,11 @@ void JavaBridgeDispatcherHostManager::RemoveNamedObject(
   }
 }
 
+void JavaBridgeDispatcherHostManager::OnGetChannelHandle(
+    RenderFrameHost* render_frame_host, IPC::Message* reply_msg) {
+  instances_[render_frame_host]->OnGetChannelHandle(reply_msg);
+}
+
 void JavaBridgeDispatcherHostManager::RenderFrameCreated(
     RenderFrameHost* render_frame_host) {
   // Creates a JavaBridgeDispatcherHost for the specified RenderViewHost and
@@ -111,25 +132,6 @@ void JavaBridgeDispatcherHostManager::DocumentAvailableInMainFrame() {
   }
 }
 
-bool JavaBridgeDispatcherHostManager::OnMessageReceived(
-    const IPC::Message& message,
-    RenderFrameHost* render_frame_host) {
-  DCHECK(render_frame_host);
-  if (!instances_.count(render_frame_host))
-    return false;
-  scoped_refptr<JavaBridgeDispatcherHost> instance =
-      instances_[render_frame_host];
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(JavaBridgeDispatcherHostManager, message)
-    IPC_MESSAGE_FORWARD_DELAY_REPLY(
-        JavaBridgeHostMsg_GetChannelHandle,
-        instance.get(),
-        JavaBridgeDispatcherHost::OnGetChannelHandle)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
 void JavaBridgeDispatcherHostManager::JavaBoundObjectCreated(
     const base::android::JavaRef<jobject>& object) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
diff --git a/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h b/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h
index 8d03576..3ada0d0 100644
--- a/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h
+++ b/content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h
@@ -28,8 +28,7 @@ class JavaBridgeDispatcherHostManager
     : public WebContentsObserver,
       public base::SupportsWeakPtr<JavaBridgeDispatcherHostManager> {
  public:
-  JavaBridgeDispatcherHostManager(WebContents* web_contents,
-                                  jobject retained_object_set);
+  explicit JavaBridgeDispatcherHostManager(WebContents* web_contents);
   virtual ~JavaBridgeDispatcherHostManager();
 
   // These methods add or remove the object to each JavaBridgeDispatcherHost.
@@ -38,12 +37,21 @@ class JavaBridgeDispatcherHostManager
   void AddNamedObject(const base::string16& name, NPObject* object);
   void RemoveNamedObject(const base::string16& name);
 
+  void OnGetChannelHandle(RenderFrameHost* render_frame_host,
+                          IPC::Message* reply_msg);
+
+  // Every time a JavaBoundObject backed by a real Java object is
+  // created/destroyed, we insert/remove a strong ref to that Java object into
+  // this set so that it doesn't get garbage collected while it's still
+  // potentially in use. Although the set is managed native side, it's owned
+  // and defined in Java so that pushing refs into it does not create new GC
+  // roots that would prevent ContentViewCore from being garbage collected.
+  void SetRetainedObjectSet(const JavaObjectWeakGlobalRef& retained_object_set);
+
   // WebContentsObserver overrides
   virtual void RenderFrameCreated(RenderFrameHost* render_frame_host) OVERRIDE;
   virtual void RenderFrameDeleted(RenderFrameHost* render_frame_host) OVERRIDE;
   virtual void DocumentAvailableInMainFrame() OVERRIDE;
-  virtual bool OnMessageReceived(const IPC::Message& message,
-                                 RenderFrameHost* render_frame_host) OVERRIDE;
 
   void JavaBoundObjectCreated(const base::android::JavaRef<jobject>& object);
   void JavaBoundObjectDestroyed(const base::android::JavaRef<jobject>& object);
@@ -59,12 +67,6 @@ class JavaBridgeDispatcherHostManager
   InstanceMap instances_;
   typedef std::map<base::string16, NPObject*> ObjectMap;
   ObjectMap objects_;
-  // Every time a JavaBoundObject backed by a real Java object is
-  // created/destroyed, we insert/remove a strong ref to that Java object into
-  // this set so that it doesn't get garbage collected while it's still
-  // potentially in use. Although the set is managed native side, it's owned
-  // and defined in Java so that pushing refs into it does not create new GC
-  // roots that would prevent ContentViewCore from being garbage collected.
   JavaObjectWeakGlobalRef retained_object_set_;
   bool allow_object_contents_inspection_;
 
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 47871dc..ea872a6 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -96,7 +96,9 @@
 #if defined(OS_ANDROID)
 #include "content/browser/android/date_time_chooser_android.h"
 #include "content/browser/media/android/browser_media_player_manager.h"
+#include "content/browser/renderer_host/java/java_bridge_dispatcher_host_manager.h"
 #include "content/browser/web_contents/web_contents_android.h"
+#include "content/common/java_bridge_messages.h"
 #include "content/public/browser/android/content_view_core.h"
 #endif
 
@@ -479,15 +481,9 @@ bool WebContentsImpl::OnMessageReceived(RenderViewHost* render_view_host,
 
   ObserverListBase<WebContentsObserver>::Iterator it(observers_);
   WebContentsObserver* observer;
-  if (render_frame_host) {
-    while ((observer = it.GetNext()) != NULL)
-      if (observer->OnMessageReceived(message, render_frame_host))
-        return true;
-  } else {
-    while ((observer = it.GetNext()) != NULL)
-      if (observer->OnMessageReceived(message))
-        return true;
-  }
+  while ((observer = it.GetNext()) != NULL)
+    if (observer->OnMessageReceived(message))
+      return true;
 
   // Message handlers should be aware of which
   // RenderViewHost/RenderFrameHost sent the message, which is temporarily
@@ -557,6 +553,8 @@ bool WebContentsImpl::OnMessageReceived(RenderViewHost* render_view_host,
                         OnFindMatchRectsReply)
     IPC_MESSAGE_HANDLER(ViewHostMsg_OpenDateTimeDialog,
                         OnOpenDateTimeDialog)
+    IPC_MESSAGE_HANDLER_DELAY_REPLY(JavaBridgeHostMsg_GetChannelHandle,
+                                    OnJavaBridgeGetChannelHandle)
 #endif
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP_EX()
@@ -1101,6 +1099,8 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
                  NOTIFICATION_RENDER_WIDGET_HOST_DESTROYED,
                  NotificationService::AllBrowserContextsAndSources());
 #if defined(OS_ANDROID)
+  java_bridge_dispatcher_host_manager_.reset(
+      new JavaBridgeDispatcherHostManager(this));
   date_time_chooser_.reset(new DateTimeChooserAndroid());
 #endif
 }
@@ -2705,6 +2705,11 @@ void WebContentsImpl::OnOpenDateTimeDialog(
                                  value.suggestions);
 }
 
+void WebContentsImpl::OnJavaBridgeGetChannelHandle(IPC::Message* reply_msg) {
+  java_bridge_dispatcher_host_manager_->OnGetChannelHandle(
+      render_frame_message_source_, reply_msg);
+}
+
 #endif
 
 void WebContentsImpl::OnPepperPluginHung(int plugin_child_id,
diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index 93563b0..92c8fea 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h
@@ -49,6 +49,7 @@ class BrowserPluginGuestManager;
 class DateTimeChooserAndroid;
 class DownloadItem;
 class InterstitialPageImpl;
+class JavaBridgeDispatcherHostManager;
 class JavaScriptDialogManager;
 class PowerSaveBlocker;
 class RenderViewHost;
@@ -119,6 +120,10 @@ class CONTENT_EXPORT WebContentsImpl
   SavePackage* save_package() const { return save_package_.get(); }
 
 #if defined(OS_ANDROID)
+  JavaBridgeDispatcherHostManager* java_bridge_dispatcher_host_manager() const {
+    return java_bridge_dispatcher_host_manager_.get();
+  }
+
   // In Android WebView, the RenderView needs created even there is no
   // navigation entry, this allows Android WebViews to use
   // javascript: URLs that load into the DOMWindow before the first page
@@ -727,6 +732,7 @@ class CONTENT_EXPORT WebContentsImpl
 
   void OnOpenDateTimeDialog(
       const ViewHostMsg_DateTimeDialogValue_Params& value);
+  void OnJavaBridgeGetChannelHandle(IPC::Message* reply_msg);
 #endif
   void OnPepperPluginHung(int plugin_child_id,
                           const base::FilePath& path,
@@ -921,6 +927,13 @@ class CONTENT_EXPORT WebContentsImpl
   // Manages the frame tree of the page and process swaps in each node.
   FrameTree frame_tree_;
 
+#if defined(OS_ANDROID)
+  // Manages injecting Java objects into all RenderViewHosts associated with
+  // this WebContentsImpl.
+  scoped_ptr<JavaBridgeDispatcherHostManager>
+      java_bridge_dispatcher_host_manager_;
+#endif
+
   // SavePackage, lazily created.
   scoped_refptr<SavePackage> save_package_;
 
diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
index 62f9f4a..e8ad655 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
@@ -609,8 +609,7 @@ public class ContentViewCore
         };
 
         mNativeContentViewCore = nativeInit(
-                nativeWebContents, viewAndroidNativePointer, windowNativePointer,
-                mRetainedJavaScriptObjects);
+                nativeWebContents, viewAndroidNativePointer, windowNativePointer);
         mWebContents = nativeGetWebContentsAndroid(mNativeContentViewCore);
         mContentSettings = new ContentSettings(this, mNativeContentViewCore);
         initializeContainerView(internalDispatcher);
@@ -2703,7 +2702,8 @@ public class ContentViewCore
             Class<? extends Annotation> requiredAnnotation) {
         if (mNativeContentViewCore != 0 && object != null) {
             mJavaScriptInterfaces.put(name, object);
-            nativeAddJavascriptInterface(mNativeContentViewCore, object, name, requiredAnnotation);
+            nativeAddJavascriptInterface(mNativeContentViewCore, object, name, requiredAnnotation,
+                    mRetainedJavaScriptObjects);
         }
     }
 
@@ -3082,7 +3082,7 @@ public class ContentViewCore
     }
 
     private native long nativeInit(long webContentsPtr,
-            long viewAndroidPtr, long windowAndroidPtr, HashSet<Object> retainedObjectSet);
+            long viewAndroidPtr, long windowAndroidPtr);
 
     @CalledByNative
     private ContentVideoViewClient getContentVideoViewClient() {
@@ -3236,7 +3236,7 @@ public class ContentViewCore
             long nativeContentViewCoreImpl, boolean allow);
 
     private native void nativeAddJavascriptInterface(long nativeContentViewCoreImpl, Object object,
-            String name, Class requiredAnnotation);
+            String name, Class requiredAnnotation, HashSet<Object> retainedObjectSet);
 
     private native void nativeRemoveJavascriptInterface(long nativeContentViewCoreImpl,
             String name);
diff --git a/content/public/browser/web_contents_observer.cc b/content/public/browser/web_contents_observer.cc
index 48fb25a..fc0fcf2 100644
--- a/content/public/browser/web_contents_observer.cc
+++ b/content/public/browser/web_contents_observer.cc
@@ -41,12 +41,6 @@ void WebContentsObserver::Observe(WebContents* web_contents) {
   }
 }
 
-bool WebContentsObserver::OnMessageReceived(
-    const IPC::Message& message,
-    RenderFrameHost* render_frame_host) {
-  return false;
-}
-
 bool WebContentsObserver::OnMessageReceived(const IPC::Message& message) {
   return false;
 }
diff --git a/content/public/browser/web_contents_observer.h b/content/public/browser/web_contents_observer.h
index 1ebb463..e0ee3b9 100644
--- a/content/public/browser/web_contents_observer.h
+++ b/content/public/browser/web_contents_observer.h
@@ -331,10 +331,6 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   virtual void AccessibilityEventReceived(
       const std::vector<AXEventNotificationDetails>& details) {}
 
-  // Invoked if an IPC message is coming from a specific RenderFrameHost.
-  virtual bool OnMessageReceived(const IPC::Message& message,
-                                 RenderFrameHost* render_frame_host);
-
   // IPC::Listener implementation.
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
diff --git a/extensions/browser/extension_function.cc b/extensions/browser/extension_function.cc
index 270f907..470ae55 100644
--- a/extensions/browser/extension_function.cc
+++ b/extensions/browser/extension_function.cc
@@ -130,16 +130,6 @@ class UIThreadExtensionFunction::RenderHostTracker
     function_->SetRenderFrameHost(NULL);
   }
 
-  virtual bool OnMessageReceived(
-      const IPC::Message& message,
-      content::RenderFrameHost* render_frame_host) OVERRIDE {
-    DCHECK(render_frame_host);
-    if (render_frame_host == function_->render_frame_host())
-      return function_->OnMessageReceived(message);
-    else
-      return false;
-  }
-
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE {
     return function_->OnMessageReceived(message);
   }