Move Renderer-side NPObject owner tracking to JavaBridgeChannel.

content/browser/renderer_host/java/java_bound_object.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/java/java_bound_object.h"
 
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
 #include "base/memory/singleton.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 195 matching lines @@
       // first.
       jobject java_object = env->CallObjectMethodA(object, id, parameters);
       if (base::android::ClearException(env)) {
         return false;
       }
       ScopedJavaLocalRef<jobject> scoped_java_object(env, java_object);
       if (!scoped_java_object.obj()) {
         NULL_TO_NPVARIANT(*result);
         break;
       }
-      OBJECT_TO_NPVARIANT(JavaBoundObject::Create(scoped_java_object,
+      // Every NPObject must have an owner. All JavaBoundObjects are owned by
+      // the JavaBridgeDispatcherHostManager, so if it's already gone, return
+      // null instead of an object.
+      if (!manager) {
+        NULL_TO_NPVARIANT(*result);
+        break;
+      }
+      OBJECT_TO_NPVARIANT(JavaBoundObject::Create(manager->object_owner_id(),
+                                                  scoped_java_object,
                                                   safe_annotation_clazz,
                                                   manager),
                           *result);
       break;
     }
   }
   return !base::android::ClearException(env);
 }
 
 double RoundDoubleTowardsZero(const double& x) {
@@ skipping 542 matching lines @@
       return CoerceJavaScriptNullOrUndefinedToJavaValue(variant, target_type,
                                                         coerce_to_string);
   }
   NOTREACHED();
   return jvalue();
 }
 
 }  // namespace
 
 NPObject* JavaBoundObject::Create(
+    struct _NPP* object_owner_id,
     const JavaRef<jobject>& object,
     const JavaRef<jclass>& safe_annotation_clazz,
     const base::WeakPtr<JavaBridgeDispatcherHostManager>& manager) {
-  // The first argument (a plugin's instance handle) is passed through to the
-  // allocate function directly, and we don't use it, so it's ok to be 0.
   // The object is created with a ref count of one.
-  NPObject* np_object = WebBindings::createObject(0, const_cast<NPClass*>(
-      &JavaNPObject::kNPClass));
+  NPObject* np_object = WebBindings::createObject(object_owner_id,
+      const_cast<NPClass*>(&JavaNPObject::kNPClass));
   // The NPObject takes ownership of the JavaBoundObject.
   reinterpret_cast<JavaNPObject*>(np_object)->bound_object =
       new JavaBoundObject(object, safe_annotation_clazz, manager);
   return np_object;
 }
 
 JavaBoundObject::JavaBoundObject(
     const JavaRef<jobject>& object,
     const JavaRef<jclass>& safe_annotation_clazz,
     const base::WeakPtr<JavaBridgeDispatcherHostManager>& manager)
@@ skipping 132 matching lines @@
       if (!safe)
         continue;
     }
 
     JavaMethod* method = new JavaMethod(java_method);
     methods_.insert(std::make_pair(method->name(), method));
   }
 }
 
 }  // namespace content