Fix up some reference counting when WebPluginImpl::scriptableObject is called.

BUG= http://code.google.com/p/chromium-os/issues/detail?id=13605
TEST=none
Review URL: http://codereview.chromium.org/6731051

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@79712 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 7 insertions, 5 deletions

diff --git a/webkit/plugins/ppapi/ppapi_webplugin_impl.cc b/webkit/plugins/ppapi/ppapi_webplugin_impl.cc
index 8e61354..8a35638 100644
--- a/webkit/plugins/ppapi/ppapi_webplugin_impl.cc
+++ b/webkit/plugins/ppapi/ppapi_webplugin_impl.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -8,6 +8,7 @@
 
 #include "base/message_loop.h"
 #include "ppapi/c/pp_var.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebBindings.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginParams.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPoint.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebRect.h"
@@ -94,11 +95,12 @@ NPObject* WebPluginImpl::scriptableObject() {
   // If there's an InstanceObject, tell the Instance's MessageChannel to pass
   // any non-postMessage calls to it.
   if (object) {
-    instance_->message_channel().set_passthrough_object(
-        object->np_object());
+    instance_->message_channel().SetPassthroughObject(object->np_object());
   }
-  // And return the instance's MessageChannel.
-  return instance_->message_channel().np_object();
+  NPObject* message_channel_np_object(instance_->message_channel().np_object());
+  // The object is expected to be retained before it is returned.
+  WebKit::WebBindings::retainObject(message_channel_np_object);
+  return message_channel_np_object;
 }
 
 void WebPluginImpl::paint(WebCanvas* canvas, const WebRect& rect) {