Fix a race condition in the Java Bridge when adding objects

content/browser/renderer_host/java/java_bridge_dispatcher_host.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_RENDERER_HOST_JAVA_JAVA_BRIDGE_DISPATCHER_HOST_H_
 #define CONTENT_BROWSER_RENDERER_HOST_JAVA_JAVA_BRIDGE_DISPATCHER_HOST_H_
 #pragma once
 
 #include "base/memory/ref_counted.h"
 #include "base/string16.h"
+#include "content/browser/renderer_host/render_view_host_observer.h"
 
-class JavaBridgeChannelHost;
+class NPChannelBase;
 class RenderViewHost;
+class RouteIDGenerator;
 struct NPObject;
+struct NPVariant_Param;
+struct _NPVariant;
+typedef _NPVariant NPVariant;

[joth, 2011/12/08 18:15:46]

these two not needed? (_NPVariant & NPVariant)

[Steve Block, 2011/12/09 12:27:32]

Done.

 
 // This class handles injecting Java objects into a single RenderView. The Java
 // object itself lives on the browser's WEBKIT thread, while a proxy object is
 // created in the renderer. An instance of this class exists for each
 // RenderViewHost.
 class JavaBridgeDispatcherHost :
+    public RenderViewHostObserver,
     public base::RefCountedThreadSafe<JavaBridgeDispatcherHost> {

[joth, 2011/12/08 18:15:46]

nit: I *think* we tend to put ABCs before interfaces. (not that it's always that
clear)

[Steve Block, 2011/12/09 12:27:32]

Done.

  public:
   // We hold a weak pointer to the RenderViewhost. It must outlive this object.
   JavaBridgeDispatcherHost(RenderViewHost* render_view_host);
 
   // Injects |object| into the main frame of the corresponding RenderView. A
   // proxy object is created in the renderer and when the main frame's window
   // object is next cleared, this proxy object is bound to the window object
   // using |name|. The proxy object remains bound until the next time the
   // window object is cleared after a call to RemoveNamedObject() or
   // AddNamedObject() with the same name. The proxy object proxies calls back
   // to |object|, which is manipulated on the WEBKIT thread. This class holds a
   // reference to |object| for the time that the proxy object is bound to the
   // window object.
   void AddNamedObject(const string16& name, NPObject* object);
   void RemoveNamedObject(const string16& name);
 
+  // RenderViewHostObserver override:
+  // The IPC macros require this to be public.
+  virtual bool Send(IPC::Message* msg) OVERRIDE;
+
  private:
   friend class base::RefCountedThreadSafe<JavaBridgeDispatcherHost>;
   ~JavaBridgeDispatcherHost();
 
-  void DoAddNamedObject(const string16& name, NPObject* object);
-  void EnsureChannelIsSetUp();
+  // RenderViewHostObserver override:
+  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
-  RenderViewHost* render_view_host_;
-  scoped_refptr<JavaBridgeChannelHost> channel_;
+  // Message handlers
+  void OnGetChannelHandle(IPC::Message* reply_msg);
+
+  void GetChannelHandle(IPC::Message* reply_msg);
+  void CreateNPVariantParam(NPObject* object, NPVariant_Param* param);
+  void CreateObjectStub(NPObject* object, int route_id);
+
+  scoped_refptr<NPChannelBase> channel_;
+  bool is_renderer_initialized_;
 
   DISALLOW_COPY_AND_ASSIGN(JavaBridgeDispatcherHost);
 };
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_JAVA_JAVA_BRIDGE_DISPATCHER_HOST_H_