Fix a bug where the JavaBridgeDispatcherHost is prematurely deleted

content/browser/renderer_host/java/java_bridge_dispatcher_host.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_RENDERER_HOST_JAVA_JAVA_BRIDGE_DISPATCHER_HOST_H_
 #define CONTENT_BROWSER_RENDERER_HOST_JAVA_JAVA_BRIDGE_DISPATCHER_HOST_H_
 #pragma once
 
 #include "base/memory/ref_counted.h"
 #include "base/string16.h"
 #include "content/browser/renderer_host/render_view_host_observer.h"
 
 class NPChannelBase;
 class RenderViewHost;
 class RouteIDGenerator;
 struct NPObject;
 struct NPVariant_Param;
 
 // This class handles injecting Java objects into a single RenderView. The Java
 // object itself lives in the browser process on a background thread, while a
 // proxy object is created in the renderer. An instance of this class exists
 // for each RenderViewHost.
 class JavaBridgeDispatcherHost
     : public base::RefCountedThreadSafe<JavaBridgeDispatcherHost>,
       public RenderViewHostObserver {

[joth, 2011/12/13 11:50:43]

multiple behavior inheritance: this is not strictly allowed, although it is
somewhat common in chrome.
Besides being banned it's the root of the problems here as both base classes
define incompatible protocols for object lifetime.

fortunately overriding RenderViewHostDestroyed() with an empty impl is pretty
common so presumably a safe enough fix. (We could add an extra ref and remove it
in RenderViewHostDestroyed() but doesn't look like that's needed)

  public:
   // We hold a weak pointer to the RenderViewhost. It must outlive this object.
   JavaBridgeDispatcherHost(RenderViewHost* render_view_host);
 
   // Injects |object| into the main frame of the corresponding RenderView. A
   // proxy object is created in the renderer and when the main frame's window
   // object is next cleared, this proxy object is bound to the window object
   // using |name|. The proxy object remains bound until the next time the
   // window object is cleared after a call to RemoveNamedObject() or
   // AddNamedObject() with the same name. The proxy object proxies calls back
   // to |object|, which is manipulated on the background thread. This class
   // holds a reference to |object| for the time that the proxy object is bound
   // to the window object.
   void AddNamedObject(const string16& name, NPObject* object);
   void RemoveNamedObject(const string16& name);
 
-  // RenderViewHostObserver override:
+  // RenderViewHostObserver overrides:
   // The IPC macros require this to be public.
   virtual bool Send(IPC::Message* msg) OVERRIDE;
+  virtual void RenderViewHostDestroyed() OVERRIDE;
 
  private:
   friend class base::RefCountedThreadSafe<JavaBridgeDispatcherHost>;
   ~JavaBridgeDispatcherHost();
 
   // RenderViewHostObserver override:
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
   // Message handlers
   void OnGetChannelHandle(IPC::Message* reply_msg);
 
   void GetChannelHandle(IPC::Message* reply_msg);
   void CreateNPVariantParam(NPObject* object, NPVariant_Param* param);
   void CreateObjectStub(NPObject* object, int route_id);
 
   scoped_refptr<NPChannelBase> channel_;
   bool is_renderer_initialized_;
 
   DISALLOW_COPY_AND_ASSIGN(JavaBridgeDispatcherHost);
 };
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_JAVA_JAVA_BRIDGE_DISPATCHER_HOST_H_