Make sure Java Bridge cleans up all stub object it creates.

content/browser/renderer_host/java/java_bridge_dispatcher_host.cc

Index: content/browser/renderer_host/java/java_bridge_dispatcher_host.cc
diff --git a/content/browser/renderer_host/java/java_bridge_dispatcher_host.cc b/content/browser/renderer_host/java/java_bridge_dispatcher_host.cc
index 3d0518c969b8f2bd799f553b6f85e91402de5fe3..0f48981d0c6bf6a906b8ebda9ffa9acf383793b9 100644
--- a/content/browser/renderer_host/java/java_bridge_dispatcher_host.cc
+++ b/content/browser/renderer_host/java/java_bridge_dispatcher_host.cc
@@ -40,6 +40,9 @@ JavaBridgeDispatcherHost::JavaBridgeDispatcherHost(
 }
 
 JavaBridgeDispatcherHost::~JavaBridgeDispatcherHost() {
+  g_background_thread.Get().message_loop()->PostTask(
+      FROM_HERE,
+      base::Bind(&JavaBridgeDispatcherHost::CleanUpStubs, stubs_));
 }
 
 void JavaBridgeDispatcherHost::AddNamedObject(const string16& name,
@@ -133,16 +136,32 @@ void JavaBridgeDispatcherHost::CreateObjectStub(NPObject* object,
         BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO));
   }
 
-  // NPObjectStub takes a ref to the NPObject. The lifetime of the NPObjectStub
-  // is governed by that of the NPObjectProxy in the renderer, via the channel.
+  // In a typical scenario, the lifetime of each NPObjectStub is governed by
+  // that of the NPObjectProxy in the renderer, via the channel. However,
+  // we cannot guaranteed that the renderer always terminates cleanly
+  // (crashes / sometimes just unavoidable). We keep a weak reference to
+  // it now and schedule a delete on it when this host is getting deleted.
+
   // Pass 0 for the containing window, as it's only used by plugins to pump the
   // window message queue when a method on a renderer-side object causes a
   // dialog to be displayed, and the Java Bridge does not need this
   // functionality. The page URL is also not required.
   new NPObjectStub(object, channel_, route_id, 0, GURL());
+  stubs_.push_back(
+      (new NPObjectStub(object, channel_, route_id, 0, GURL()))->AsWeakPtr());
+
   // The NPObjectStub takes a reference to the NPObject. Release the ref added
   // in CreateNPVariantParam().
   WebKit::WebBindings::releaseObject(object);
 }
 
+void JavaBridgeDispatcherHost::CleanUpStubs(
+    std::vector<base::WeakPtr<NPObjectStub> > stubs) {

[darin (slow to review), 2012/11/15 21:08:59]

are you sure you want to pass by value here?

[acleung, 2012/11/15 22:39:40]

I thought about that a bit. If I pass by reference, CleanUpStubs can be called
when this host is gone.

Am I correct?

+  for (size_t i = 0; i < stubs.size(); ++i) {
+   if (stubs[i]) {

[darin (slow to review), 2012/11/15 21:08:59]

nit: indentation

[acleung, 2012/11/15 22:39:40]

Done.

+     stubs[i]->DeleteSoon();
+   }
+  }
+}
+
 }  // namespace content