Fix up some reference counting when WebPluginImpl::scriptableObject is called.

webkit/plugins/ppapi/ppapi_webplugin_impl.cc

-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppapi_webplugin_impl.h"
 
 #include <cmath>
 
 #include "base/message_loop.h"
 #include "ppapi/c/pp_var.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginParams.h"
@@ skipping 75 matching lines @@
 
   MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 NPObject* WebPluginImpl::scriptableObject() {
   scoped_refptr<ObjectVar> object(
       ObjectVar::FromPPVar(instance_->GetInstanceObject()));
   // If there's an InstanceObject, tell the Instance's MessageChannel to pass
   // any non-postMessage calls to it.
   if (object) {
-    instance_->message_channel().set_passthrough_object(
-        object->np_object());
+    instance_->message_channel().set_passthrough_object(object->np_object());

[piman, 2011/03/29 16:19:47]

The message channel should also retain the passthrough object when setting it,
and releasing it when done.

[dmichael(do not use this one), 2011/03/29 16:56:10]

That's what I thought...  I was trying to slap together a CL to address what I
thought was your initial diagnosis, and slapped it together too quickly.

   }
-  // And return the instance's MessageChannel.
-  return instance_->message_channel().np_object();
+  NPObject* message_channel_np_object;

[piman, 2011/03/29 16:19:47]

= instance_->message_channel().np_object() ?

[dmichael(do not use this one), 2011/03/29 16:56:10]

Yeah, I hit send too hastily.  Sorry.

+  // The object is expected to be retained before it is returned.
+  WebBindings::retainObject(message_channel_np_object);
+  return message_channel_np_object;
 }
 
 void WebPluginImpl::paint(WebCanvas* canvas, const WebRect& rect) {
   if (!instance_->IsFullscreenOrPending())
     instance_->Paint(canvas, plugin_rect_, rect);
 }
 
 void WebPluginImpl::updateGeometry(
     const WebRect& window_rect,
     const WebRect& clip_rect,
@@ skipping 110 matching lines @@
   return instance_->PrintPage(page_number, canvas);
 }
 
 void WebPluginImpl::printEnd() {
   return instance_->PrintEnd();
 }
 
 }  // namespace ppapi
 }  // namespace webkit