Move Renderer-side NPObject owner tracking to JavaBridgeChannel.

This is defensive against the possibility of a single JavaBridgeChannel to the Browser hosting multiple JavaBridgeDispatchers.

BUG=152006

Review URL: https://chromiumcodereview.appspot.com/18570003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@210343 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 14 insertions, 13 deletions

diff --git a/content/renderer/java/java_bridge_channel.cc b/content/renderer/java/java_bridge_channel.cc
index 7d95421..235425a 100644
--- a/content/renderer/java/java_bridge_channel.cc
+++ b/content/renderer/java/java_bridge_channel.cc
@@ -7,6 +7,7 @@
 #include "content/child/child_process.h"
 #include "content/child/plugin_messages.h"
 #include "content/common/java_bridge_messages.h"
+#include "third_party/WebKit/public/web/WebBindings.h"
 
 namespace content {
 
@@ -22,10 +23,16 @@ JavaBridgeChannel* JavaBridgeChannel::GetJavaBridgeChannel(
       ChildProcess::current()->GetShutDownEvent()));
 }
 
-JavaBridgeChannel::JavaBridgeChannel() {
+JavaBridgeChannel::JavaBridgeChannel()
+    : peer_owner_id_(new struct _NPP) {
+  // Register the dummy owner Id for our peer (the Browser process) as an object
+  // owner, and have all objects received from the peer owned by it.
+  WebKit::WebBindings::registerObjectOwner(peer_owner_id_.get());
+  SetDefaultNPObjectOwner(peer_owner_id_.get());
 }
 
 JavaBridgeChannel::~JavaBridgeChannel() {
+  WebKit::WebBindings::unregisterObjectOwner(peer_owner_id_.get());
 }
 
 int JavaBridgeChannel::GenerateRouteID() {
diff --git a/content/renderer/java/java_bridge_channel.h b/content/renderer/java/java_bridge_channel.h
index dbedceec..324a3a2 100644
--- a/content/renderer/java/java_bridge_channel.h
+++ b/content/renderer/java/java_bridge_channel.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_RENDERER_JAVA_JAVA_BRIDGE_CHANNEL_H_
 #define CONTENT_RENDERER_JAVA_JAVA_BRIDGE_CHANNEL_H_
 
+#include "base/memory/scoped_ptr.h"
 #include "content/child/np_channel_base.h"
 #include "ipc/ipc_channel_handle.h"
 
@@ -30,6 +31,10 @@ class JavaBridgeChannel : public content::NPChannelBase {
 
   static NPChannelBase* ClassFactory() { return new JavaBridgeChannel(); }
 
+  // Dummy NPObject owner Id used to track objects owned by the JavaBridge
+  // peer in the Browser process.
+  scoped_ptr<struct _NPP> peer_owner_id_;
+
   DISALLOW_COPY_AND_ASSIGN(JavaBridgeChannel);
 };
 
diff --git a/content/renderer/java/java_bridge_dispatcher.cc b/content/renderer/java/java_bridge_dispatcher.cc
index af899a0..c0b5994 100644
--- a/content/renderer/java/java_bridge_dispatcher.cc
+++ b/content/renderer/java/java_bridge_dispatcher.cc
@@ -18,8 +18,7 @@
 namespace content {
 
 JavaBridgeDispatcher::JavaBridgeDispatcher(RenderView* render_view)
-    : RenderViewObserver(render_view), owner_id_(new struct _NPP) {
-  WebKit::WebBindings::registerObjectOwner(owner_id_.get());
+    : RenderViewObserver(render_view) {
 }
 
 void JavaBridgeDispatcher::EnsureChannelIsSetUp() {
@@ -32,10 +31,6 @@ void JavaBridgeDispatcher::EnsureChannelIsSetUp() {
 
   channel_ = JavaBridgeChannel::GetJavaBridgeChannel(
       channel_handle, ChildProcess::current()->io_message_loop_proxy());
-
-  // All objects received from the Browser process belong to us.
-  if (channel_.get())
-    channel_->SetDefaultNPObjectOwner(owner_id_.get());
 }
 
 JavaBridgeDispatcher::~JavaBridgeDispatcher() {
@@ -43,8 +38,6 @@ JavaBridgeDispatcher::~JavaBridgeDispatcher() {
       iter != objects_.end(); ++iter) {
     WebKit::WebBindings::releaseObject(NPVARIANT_TO_OBJECT(iter->second));
   }
-
-  WebKit::WebBindings::unregisterObjectOwner(owner_id_.get());
 }
 
 bool JavaBridgeDispatcher::OnMessageReceived(const IPC::Message& msg) {
diff --git a/content/renderer/java/java_bridge_dispatcher.h b/content/renderer/java/java_bridge_dispatcher.h
index 4cb34b5..29a10374 100644
--- a/content/renderer/java/java_bridge_dispatcher.h
+++ b/content/renderer/java/java_bridge_dispatcher.h
@@ -8,13 +8,10 @@
 #include <map>
 
 #include "base/memory/ref_counted.h"
-#include "base/memory/scoped_ptr.h"
 #include "content/public/renderer/render_view_observer.h"
 #include "ipc/ipc_channel_handle.h"
 #include "third_party/npapi/bindings/npruntime.h"
 
-struct _NPP;
-
 namespace content {
 class JavaBridgeChannel;
 struct NPVariant_Param;
@@ -47,7 +44,6 @@ class JavaBridgeDispatcher : public RenderViewObserver {
   typedef std::map<string16, NPVariant> ObjectMap;
   ObjectMap objects_;
   scoped_refptr<JavaBridgeChannel> channel_;
-  scoped_ptr<struct _NPP> owner_id_;
 };
 
 }  // namespace content