Fix up some reference counting when WebPluginImpl::scriptableObject is called.

webkit/plugins/ppapi/ppapi_webplugin_impl.cc

Index: webkit/plugins/ppapi/ppapi_webplugin_impl.cc
===================================================================
--- webkit/plugins/ppapi/ppapi_webplugin_impl.cc	(revision 79559)
+++ webkit/plugins/ppapi/ppapi_webplugin_impl.cc	(working copy)
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -94,11 +94,12 @@
   // If there's an InstanceObject, tell the Instance's MessageChannel to pass
   // any non-postMessage calls to it.
   if (object) {
-    instance_->message_channel().set_passthrough_object(
-        object->np_object());
+    instance_->message_channel().set_passthrough_object(object->np_object());

[piman, 2011/03/29 16:19:47]

The message channel should also retain the passthrough object when setting it,
and releasing it when done.

[dmichael(do not use this one), 2011/03/29 16:56:10]

That's what I thought...  I was trying to slap together a CL to address what I
thought was your initial diagnosis, and slapped it together too quickly.

   }
-  // And return the instance's MessageChannel.
-  return instance_->message_channel().np_object();
+  NPObject* message_channel_np_object;

[piman, 2011/03/29 16:19:47]

= instance_->message_channel().np_object() ?

[dmichael(do not use this one), 2011/03/29 16:56:10]

Yeah, I hit send too hastily.  Sorry.

+  // The object is expected to be retained before it is returned.
+  WebBindings::retainObject(message_channel_np_object);
+  return message_channel_np_object;
 }
 
 void WebPluginImpl::paint(WebCanvas* canvas, const WebRect& rect) {