Fix up some reference counting when WebPluginImpl::scriptableObject is called.

webkit/plugins/ppapi/plugin_object.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/plugin_object.h"
 
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/string_number_conversions.h"
@@ skipping 272 matching lines @@
 
   // This object will register itself both with the NPObject and with the
   // PluginModule. The NPObject will normally handle its lifetime, and it
   // will get deleted in the destroy method. It may also get deleted when the
   // plugin module is deallocated.
   new PluginObject(instance, wrapper, ppp_class, ppp_class_data);
 
   // We can just use a normal ObjectVar to refer to this object from the
   // plugin. It will hold a ref to the underlying NPObject which will in turn
   // hold our pluginObject.
-  return ObjectVar::NPObjectToPPVar(instance, wrapper);
+  PP_Var obj_var(ObjectVar::NPObjectToPPVar(instance, wrapper));
+
+  // Note that the ObjectVar constructor incremented the reference count, and so
+  // did WebBindings::createObject above. Now that the PP_Var has taken
+  // ownership, we need to release to balance out the createObject reference
+  // count bump.
+  WebBindings::releaseObject(wrapper);
+  return obj_var;
 }
 
 NPObject* PluginObject::GetNPObject() const {
   return object_wrapper_;
 }
 
 // static
 bool PluginObject::IsInstanceOf(NPObject* np_object,
                                 const PPP_Class_Deprecated* ppp_class,
                                 void** ppp_class_data) {
@@ skipping 21 matching lines @@
 // static
 NPObject* PluginObject::AllocateObjectWrapper() {
   NPObjectWrapper* wrapper = new NPObjectWrapper;
   memset(wrapper, 0, sizeof(NPObjectWrapper));
   return wrapper;
 }
 
 }  // namespace ppapi
 }  // namespace webkit