[Android] Fix leak in Java Bridge.

content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java

Index: content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
index e19ae11858a2df90c41b5d196005e7b8306606b0..c739a106317edbbdcc56672321b6f1c0f40b5453 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
@@ -47,6 +47,8 @@ import org.chromium.content.common.TraceEvent;
 import org.chromium.ui.gfx.NativeWindow;
 
 import java.lang.annotation.Annotation;
+import java.util.HashMap;
+import java.util.Map;
 
 /**
  * Provides a Java-side 'wrapper' around a WebContent (native) instance.
@@ -73,6 +75,8 @@ public class ContentViewCore implements MotionEventDelegate, NavigationClient {
     // Personality of the ContentView.
     private final int mPersonality;
 
+    private Map<String, Object> mJavaScriptObjects = new HashMap<String, Object>();

[joth, 2013/01/07 19:32:41]

comment what this is for / why the native side only holds weak refs etc.

[benm (inactive), 2013/01/08 14:43:05]

Done.

+
     /**
      * Interface that consumers of {@link ContentViewCore} must implement to allow the proper
      * dispatching of view methods through the containing view.
@@ -2193,6 +2197,7 @@ public class ContentViewCore implements MotionEventDelegate, NavigationClient {
     public void addPossiblyUnsafeJavascriptInterface(Object object, String name,
             Class<? extends Annotation> requiredAnnotation) {
         if (mNativeContentViewCore != 0 && object != null) {
+            mJavaScriptObjects.put(name, object);
             nativeAddJavascriptInterface(mNativeContentViewCore, object, name, requiredAnnotation);
         }
     }
@@ -2204,6 +2209,7 @@ public class ContentViewCore implements MotionEventDelegate, NavigationClient {
      */
     public void removeJavascriptInterface(String name) {
         if (mNativeContentViewCore != 0) {
+            mJavaScriptObjects.remove(name);
             nativeRemoveJavascriptInterface(mNativeContentViewCore, name);

[joth, 2013/01/07 19:32:41]

I'd rather nativeRemoveJavascriptInterface returned the jobject that
corresponded to |object| originally passed into nativeAddJavascriptInterface so
then we could just remove that from a 'set' here (to avoid the duplicate
name->object maps on both sides).
But a cursory read of the native-side code, I can't easily see how it could do
that: I think it just sends IPC to renderer, and only when that is responded to
does it remove the browser side object containing the weak ref. we definitely
should remove the java-side object synchronously like you are here (and be aware
that this means we may open a window when the weak ref will be referring to
NULL) so using the name->object map here as you have it is probably best choice.

         }
     }