Make sure Java Bridge cleans up all stub object it creates.

content/browser/renderer_host/java/java_bridge_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/java/java_bridge_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/lazy_instance.h"
 #include "base/threading/thread.h"
 #include "content/browser/renderer_host/java/java_bridge_channel_host.h"
@@ skipping 11 matching lines @@
 namespace {
 class JavaBridgeThread : public base::Thread {
  public:
   JavaBridgeThread() : base::Thread("JavaBridge") {
     Start();
   }
   virtual ~JavaBridgeThread() {
     Stop();
   }
 };
+
+void CleanUpStubs(std::vector<base::WeakPtr<NPObjectStub> > stubs) {
+  for (size_t i = 0; i < stubs.size(); ++i) {
+    if (stubs[i]) {
+      stubs[i]->DeleteSoon();
+    }
+  }
+}
+
 base::LazyInstance<JavaBridgeThread> g_background_thread =
     LAZY_INSTANCE_INITIALIZER;
 }  // namespace
 
 JavaBridgeDispatcherHost::JavaBridgeDispatcherHost(
     RenderViewHost* render_view_host)
     : RenderViewHostObserver(render_view_host),
       is_renderer_initialized_(false) {
 }
 
 JavaBridgeDispatcherHost::~JavaBridgeDispatcherHost() {
+  g_background_thread.Get().message_loop()->PostTask(
+      FROM_HERE,
+      base::Bind(&CleanUpStubs, stubs_));

[joth, 2012/11/15 23:29:07]

under the covers, Bind copy-constructs a copy of all params passed and keeps
them around until the bound method was run. So it's that copy you'll be taking a
reference to in the function param.
You can convince yourself of this either by logging the address of stubs_ and
seeing they're different instances, or by digging through the docs on Bind. :)

[acleung, 2012/11/16 02:07:18]

Checked the docs. You are absolutely right.

 }
 
 void JavaBridgeDispatcherHost::AddNamedObject(const string16& name,
                                               NPObject* object) {
   NPVariant_Param variant_param;
   CreateNPVariantParam(object, &variant_param);
 
   if (!is_renderer_initialized_) {
     is_renderer_initialized_ = true;
     Send(new JavaBridgeMsg_Init(routing_id()));
@@ skipping 73 matching lines @@
 
 void JavaBridgeDispatcherHost::CreateObjectStub(NPObject* object,
                                                 int route_id) {
   DCHECK_EQ(g_background_thread.Get().message_loop(), MessageLoop::current());
   if (!channel_) {
     channel_ = JavaBridgeChannelHost::GetJavaBridgeChannelHost(
         render_view_host()->GetProcess()->GetID(),
         BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO));
   }
 
-  // NPObjectStub takes a ref to the NPObject. The lifetime of the NPObjectStub
-  // is governed by that of the NPObjectProxy in the renderer, via the channel.
+  // In a typical scenario, the lifetime of each NPObjectStub is governed by
+  // that of the NPObjectProxy in the renderer, via the channel. However,
+  // we cannot guaranteed that the renderer always terminates cleanly
+  // (crashes / sometimes just unavoidable). We keep a weak reference to
+  // it now and schedule a delete on it when this host is getting deleted.
+
   // Pass 0 for the containing window, as it's only used by plugins to pump the
   // window message queue when a method on a renderer-side object causes a
   // dialog to be displayed, and the Java Bridge does not need this
   // functionality. The page URL is also not required.
   new NPObjectStub(object, channel_, route_id, 0, GURL());
+  stubs_.push_back(
+      (new NPObjectStub(object, channel_, route_id, 0, GURL()))->AsWeakPtr());
+
   // The NPObjectStub takes a reference to the NPObject. Release the ref added
   // in CreateNPVariantParam().
   WebKit::WebBindings::releaseObject(object);
 }
 
 }  // namespace content