Fix up some reference counting when WebPluginImpl::scriptableObject is called.

webkit/plugins/ppapi/message_channel.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/message_channel.h"
 
 #include <cstdlib>
 #include <string>
 
 #include "base/logging.h"
@@ skipping 264 matching lines @@
 
 MessageChannel::MessageChannelNPObject::~MessageChannelNPObject() {}
 
 MessageChannel::MessageChannel(PluginInstance* instance)
     : instance_(instance),
       passthrough_object_(NULL),
       np_object_(NULL),
       ALLOW_THIS_IN_INITIALIZER_LIST(method_factory_(this)) {
   VOID_TO_NPVARIANT(onmessage_invoker_);
 
-  // Now create an NPObject for receiving calls to postMessage.
+  // Now create an NPObject for receiving calls to postMessage. This sets the
+  // reference count to 1.  We release it in the destructor.
   NPObject* obj = WebBindings::createObject(NULL, &message_channel_class);
   DCHECK(obj);
   np_object_ = static_cast<MessageChannel::MessageChannelNPObject*>(obj);
   np_object_->message_channel = this;
 }
 
 bool MessageChannel::EvaluateOnMessageInvoker() {
   // If we've already evaluated the function, just return.
   if (NPVARIANT_IS_OBJECT(onmessage_invoker_))
     return true;
@@ skipping 78 matching lines @@
           &MessageChannel::PostMessageToNativeImpl,
           var_copy));
 }
 
 void MessageChannel::PostMessageToNativeImpl(PP_Var message_data) {
   instance_->HandleMessage(message_data);
 }
 
 MessageChannel::~MessageChannel() {
   WebBindings::releaseObject(np_object_);
+  if (passthrough_object_)
+    WebBindings::releaseObject(passthrough_object_);
   WebBindings::releaseVariantValue(&onmessage_invoker_);
 }
 
+void MessageChannel::SetPassthroughObject(NPObject* passthrough) {
+  // Retain the passthrough object; We need to ensure it lives as long as this
+  // MessageChannel.
+  WebBindings::retainObject(passthrough);
+
+  // If we had a passthrough set already, release it. Note that we retain the
+  // incoming passthrough object first, so that we behave correctly if anyone
+  // invokes:
+  //   SetPassthroughObject(passthrough_object());
+  if (passthrough_object_)
+    WebBindings::releaseObject(passthrough_object_);
+
+  passthrough_object_ = passthrough;
+}
+
 }  // namespace ppapi
 }  // namespace webkit