Revert 202364 "Track NPObject ownership by the originating plugi..."

trunk/src/webkit/glue/cpp_bound_class.cc

Index: trunk/src/webkit/glue/cpp_bound_class.cc
===================================================================
--- trunk/src/webkit/glue/cpp_bound_class.cc	(revision 202368)
+++ trunk/src/webkit/glue/cpp_bound_class.cc	(working copy)
@@ -177,13 +177,16 @@
   return obj->bound_class->SetProperty(ident, value);
 }
 
-CppBoundClass::CppBoundClass() : npp_(new NPP_t) {
-  WebBindings::registerObjectOwner(npp_.get());
+CppBoundClass::CppBoundClass()
+    : bound_to_frame_(false) {
 }
 
 CppBoundClass::~CppBoundClass() {
   STLDeleteValues(&properties_);
-  WebBindings::unregisterObjectOwner(npp_.get());
+
+  // Unregister ourselves if we were bound to a frame.
+  if (bound_to_frame_)
+    WebBindings::unregisterObject(NPVARIANT_TO_OBJECT(self_variant_));
 }
 
 bool CppBoundClass::HasMethod(NPIdentifier ident) const {
@@ -297,10 +300,10 @@
 
 CppVariant* CppBoundClass::GetAsCppVariant() {
   if (!self_variant_.isObject()) {
-    // Create an NPObject using our static NPClass.  The first argument has type
-    // NPP, but is only used to track object ownership, so passing this is fine.
-    NPObject* np_obj = WebBindings::createObject(
-        npp_.get(), &CppNPObject::np_class_);
+    // Create an NPObject using our static NPClass.  The first argument (a
+    // plugin's instance handle) is passed through to the allocate function
+    // directly, and we don't use it, so it's ok to be 0.
+    NPObject* np_obj = WebBindings::createObject(0, &CppNPObject::np_class_);
     CppNPObject* obj = reinterpret_cast<CppNPObject*>(np_obj);
     obj->bound_class = this;
     self_variant_.Set(np_obj);
@@ -313,11 +316,11 @@
 void CppBoundClass::BindToJavascript(WebFrame* frame,
                                      const std::string& classname) {
   // BindToWindowObject will take its own reference to the NPObject, and clean
-  // up after itself. It will also (indirectly) register the object with V8,
-  // against an owner pointer we supply, so we must register that as an owner,
-  // and unregister when we teardown.
+  // up after itself.  It will also (indirectly) register the object with V8,
+  // so we must remember this so we can unregister it when we're destroyed.
   frame->bindToWindowObject(ASCIIToUTF16(classname),
                             NPVARIANT_TO_OBJECT(*GetAsCppVariant()));
+  bound_to_frame_ = true;
 }
 
 }  // namespace webkit_glue