Fix up some reference counting when WebPluginImpl::scriptableObject is called.

webkit/plugins/ppapi/message_channel.cc

Index: webkit/plugins/ppapi/message_channel.cc
===================================================================
--- webkit/plugins/ppapi/message_channel.cc	(revision 79559)
+++ webkit/plugins/ppapi/message_channel.cc	(working copy)
@@ -282,7 +282,8 @@
       ALLOW_THIS_IN_INITIALIZER_LIST(method_factory_(this)) {
   VOID_TO_NPVARIANT(onmessage_invoker_);
 
-  // Now create an NPObject for receiving calls to postMessage.
+  // Now create an NPObject for receiving calls to postMessage. This sets the
+  // reference count to 1.  We release it in the destructor.
   NPObject* obj = WebBindings::createObject(NULL, &message_channel_class);
   DCHECK(obj);
   np_object_ = static_cast<MessageChannel::MessageChannelNPObject*>(obj);
@@ -381,9 +382,20 @@
 
 MessageChannel::~MessageChannel() {
   WebBindings::releaseObject(np_object_);
+  if (passthrough_object_)
+    WebBindings::releaseObject(passthrough_object_);
   WebBindings::releaseVariantValue(&onmessage_invoker_);
 }
 
+void MessageChannel::SetPassthroughObject(NPObject* passthrough) {
+  if (passthrough_object_)
+    WebBindings::releaseObject(passthrough_object_);
+  passthrough_object_ = passthrough;
+  // Retain the passthrough object; We need to ensure it lives as long as this
+  // MessageChannel.
+  WebBindings::retainObject(passthrough_object_);

[piman, 2011/03/29 17:36:10]

Do you mind retaining before releasing ? Just in case someone ends up doing
SetPassthroughObject(passthrough_object()).

[dmichael(do not use this one), 2011/03/29 18:03:21]

Done.  (Although I might argue that anyone doing that deserves a crash :-p)

+}
+
 }  // namespace ppapi
 }  // namespace webkit