[Android] Fix crash in Java Bridge.

If we attempt to add a Java interface during Renderer shutdown,
we abort adding that interface. But then still assert that something
was added if we later try to remove that interface. So we should
early out also in the case that we get a call to remove while the
Renderer is shutting down.

BUG=b/8707888

Review URL: https://chromiumcodereview.appspot.com/17284005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@206928 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 10 insertions, 5 deletions

diff --git a/content/renderer/java/java_bridge_dispatcher.cc b/content/renderer/java/java_bridge_dispatcher.cc
index 1eeac19..c0b5994 100644
--- a/content/renderer/java/java_bridge_dispatcher.cc
+++ b/content/renderer/java/java_bridge_dispatcher.cc
@@ -21,9 +21,9 @@ JavaBridgeDispatcher::JavaBridgeDispatcher(RenderView* render_view)
     : RenderViewObserver(render_view) {
 }
 
-bool JavaBridgeDispatcher::EnsureChannelIsSetUp() {
+void JavaBridgeDispatcher::EnsureChannelIsSetUp() {
   if (channel_.get()) {
-    return true;
+    return;
   }
 
   IPC::ChannelHandle channel_handle;
@@ -31,7 +31,6 @@ bool JavaBridgeDispatcher::EnsureChannelIsSetUp() {
 
   channel_ = JavaBridgeChannel::GetJavaBridgeChannel(
       channel_handle, ChildProcess::current()->io_message_loop_proxy());
-  return channel_.get();
 }
 
 JavaBridgeDispatcher::~JavaBridgeDispatcher() {
@@ -70,7 +69,8 @@ void JavaBridgeDispatcher::OnAddNamedObject(
     const NPVariant_Param& variant_param) {
   DCHECK_EQ(variant_param.type, NPVARIANT_PARAM_SENDER_OBJECT_ROUTING_ID);
 
-  if (!EnsureChannelIsSetUp()) {
+  EnsureChannelIsSetUp();
+  if (!channel_.get()) {
     // It's possible for |channel_| to be NULL if the RenderView is going away.
     return;
   }
@@ -96,6 +96,11 @@ void JavaBridgeDispatcher::OnAddNamedObject(
 }
 
 void JavaBridgeDispatcher::OnRemoveNamedObject(const string16& name) {
+  if (!channel_.get()) {
+    DCHECK(objects_.empty());
+    return;
+  }
+
   // Removing an object does not unbind it from JavaScript until the window
   // object is next cleared. Note that the browser checks that the named object
   // is present.
diff --git a/content/renderer/java/java_bridge_dispatcher.h b/content/renderer/java/java_bridge_dispatcher.h
index df32831..29a10374 100644
--- a/content/renderer/java/java_bridge_dispatcher.h
+++ b/content/renderer/java/java_bridge_dispatcher.h
@@ -37,7 +37,7 @@ class JavaBridgeDispatcher : public RenderViewObserver {
                         const NPVariant_Param& variant_param);
   void OnRemoveNamedObject(const string16& name);
 
-  bool EnsureChannelIsSetUp();
+  void EnsureChannelIsSetUp();
 
   // Objects that will be bound to the window when the window object is next
   // cleared. We hold a ref to these.