Fix a bug where the JavaBridgeDispatcherHost is prematurely deleted

content/browser/renderer_host/java/java_bridge_dispatcher_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/java/java_bridge_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/lazy_instance.h"
 #include "base/threading/thread.h"
 #include "content/browser/renderer_host/java/java_bridge_channel_host.h"
@@ skipping 30 matching lines @@
 JavaBridgeDispatcherHost::~JavaBridgeDispatcherHost() {
 }
 
 void JavaBridgeDispatcherHost::AddNamedObject(const string16& name,
                                               NPObject* object) {
   NPVariant_Param variant_param;
   CreateNPVariantParam(object, &variant_param);
 
   if (!is_renderer_initialized_) {
     is_renderer_initialized_ = true;
     Send(new JavaBridgeMsg_Init(routing_id()));

[joth, 2011/12/13 11:50:43]

note the RVH may have gone away (due to ref-count we can out live it) so this
Send may return false. I'm not sure what it really means in this case anyway.

[Steve Block, 2011/12/13 12:40:20]

I don't think this is a problem, as the JavaBridgeDispatcherHostManager should
never call these methods on this object once the corresponding RenderViewHost
has been deleted.

   }
   Send(new JavaBridgeMsg_AddNamedObject(routing_id(), name, variant_param));
 }
 
 void JavaBridgeDispatcherHost::RemoveNamedObject(const string16& name) {
   // On receipt of this message, the JavaBridgeDispatcher will drop its
   // reference to the corresponding proxy object. When the last reference is
   // removed, the proxy object will delete its NPObjectProxy, which will cause
   // the NPObjectStub to be deleted, which will drop its reference to the
   // original NPObject.
   Send(new JavaBridgeMsg_RemoveNamedObject(routing_id(), name));
 }
 
 bool JavaBridgeDispatcherHost::Send(IPC::Message* msg) {

[joth, 2011/12/13 11:50:43]

aside (not for this CL) - is this Send() override needed? AFAICS it's only
called from within this class.

[Steve Block, 2011/12/13 12:40:20]

Yes, I think it is, as we need to make Send() public for use with the delayed
response message macros. RenderViewHostObserver::Send() is protected.

   return RenderViewHostObserver::Send(msg);
 }
 
+void JavaBridgeDispatcherHost::RenderViewHostDestroyed() {
+  // Base implementation deletes the object. This class is ref counted, with
+  // refs held by the JavaBridgeDispatcherHostManager and base::Bind, so this

[joth, 2011/12/13 11:50:43]

nit: this behavior -> that behavior.

[Steve Block, 2011/12/13 12:40:20]

Done.

+  // behavior is unwanted.
+}
+
 bool JavaBridgeDispatcherHost::OnMessageReceived(const IPC::Message& msg) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(JavaBridgeDispatcherHost, msg)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(JavaBridgeHostMsg_GetChannelHandle,
                                     OnGetChannelHandle)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
@@ skipping 48 matching lines @@
 
   // NPObjectStub takes a ref to the NPObject. The lifetime of the NPObjectStub
   // is governed by that of the NPObjectProxy in the renderer, via the channel.
   // We don't need the containing window or the page URL, as we don't do
   // re-entrant sync IPC.
   new NPObjectStub(object, channel_, route_id, 0, GURL());
   // The NPObjectStub takes a reference to the NPObject. Release the ref added
   // in CreateNPVariantParam().
   WebKit::WebBindings::releaseObject(object);
 }