Track NPObject ownership by the originating plugins' NPP identifier. [4/6] (Chrome)

content/plugin/webplugin_delegate_stub.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/plugin/webplugin_delegate_stub.h"
 
 #include "build/build_config.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 22 matching lines @@
 namespace content {
 
 static void DestroyWebPluginAndDelegate(
     base::WeakPtr<NPObjectStub> scriptable_object,
     webkit::npapi::WebPluginDelegateImpl* delegate,
     WebPlugin* webplugin) {
   // The plugin may not expect us to try to release the scriptable object
   // after calling NPP_Destroy on the instance, so delete the stub now.
   if (scriptable_object.get())
     scriptable_object->DeleteSoon();
+
+  // Un-register the plugin instance as an object owner.
+  WebBindings::unregisterObjectOwner(delegate->GetPluginNPP());
+
   // WebPlugin must outlive WebPluginDelegate.
   if (delegate)
     delegate->PluginDestroyed();
 
   delete webplugin;
 }
 
 WebPluginDelegateStub::WebPluginDelegateStub(
     const std::string& mime_type, int instance_id, PluginChannel* channel) :
     mime_type_(mime_type),
@@ skipping 16 matching lines @@
         FROM_HERE,
         base::Bind(&DestroyWebPluginAndDelegate,
                    plugin_scriptable_object_,
                    delegate_,
                    webplugin_));
   } else {
     // Safe to delete right away.
     DestroyWebPluginAndDelegate(
         plugin_scriptable_object_, delegate_, webplugin_);
   }
+
+  // Remove the NPObject owner mapping for this instance.
+  channel_->RemoveMappingForNPObjectOwner(instance_id_);
 }
 
 bool WebPluginDelegateStub::OnMessageReceived(const IPC::Message& msg) {
   GetContentClient()->SetActiveURL(page_url_);
 
   // A plugin can execute a script to delete itself in any of its NPP methods.
   // Hold an extra reference to ourself so that if this does occur and we're
   // handling a sync message, we don't crash when attempting to send a reply.
   // The exception to this is when we're already in the destructor.
   if (!in_destructor_)
@@ skipping 79 matching lines @@
   webplugin_ = new WebPluginProxy(channel_.get(),
                                   instance_id_,
                                   page_url_,
                                   params.host_render_view_routing_id);
   delegate_ = webkit::npapi::WebPluginDelegateImpl::Create(path, mime_type_);
   if (delegate_) {
     webplugin_->set_delegate(delegate_);
     std::vector<std::string> arg_names = params.arg_names;
     std::vector<std::string> arg_values = params.arg_values;
 
+    // Register the plugin as a valid object owner.
+    WebBindings::registerObjectOwner(delegate_->GetPluginNPP());
+
+    // Add an NPObject owner mapping for this instance, to support ownership
+    // tracking in the renderer.
+    channel_->AddMappingForNPObjectOwner(instance_id_,
+                                         delegate_->GetPluginNPP());
+
     *result = delegate_->Initialize(params.url,
                                     arg_names,
                                     arg_values,
                                     webplugin_,
                                     params.load_manually);
     *transparent = delegate_->instance()->transparent();
   }
 }
 
 void WebPluginDelegateStub::OnWillSendRequest(int id, const GURL& url,
@@ skipping 204 matching lines @@
 }
 
 void WebPluginDelegateStub::OnHTTPRangeRequestReply(
     unsigned long resource_id, int range_request_id) {
   WebPluginResourceClient* resource_client =
       delegate_->CreateSeekableResourceClient(resource_id, range_request_id);
   webplugin_->OnResourceCreated(resource_id, resource_client);
 }
 
 }  // namespace content