[Android] Implement renderer side of Gin Java Bridge

content/renderer/java/gin_java_bridge_dispatcher.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/java/gin_java_bridge_dispatcher.h"
+
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/utf_string_conversions.h"
+#include "content/common/gin_java_bridge_messages.h"
+#include "content/public/renderer/render_frame.h"
+#include "content/renderer/java/gin_java_bridge_object.h"
+#include "third_party/WebKit/public/web/WebFrame.h"
+#include "third_party/WebKit/public/web/WebView.h"
+
+namespace content {
+
+GinJavaBridgeDispatcher::GinJavaBridgeDispatcher(RenderFrame* render_frame)
+    : RenderFrameObserver(render_frame) {
+}
+
+GinJavaBridgeDispatcher::~GinJavaBridgeDispatcher() {
+}
+
+bool GinJavaBridgeDispatcher::OnMessageReceived(const IPC::Message& msg) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(GinJavaBridgeDispatcher, msg)
+    IPC_MESSAGE_HANDLER(GinJavaBridgeMsg_AddNamedObject, OnAddNamedObject)
+    IPC_MESSAGE_HANDLER(GinJavaBridgeMsg_RemoveNamedObject, OnRemoveNamedObject)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  return handled;
+}
+
+void GinJavaBridgeDispatcher::DidClearWindowObject(int world_id) {
+  if (world_id != 0)
+    return;
+
+  for (NamedObjectMap::const_iterator iter = named_objects_.begin();
+       iter != named_objects_.end(); ++iter) {
+    // A wrapper can already be collected, as we don't hold persistent
+    // handles for them to avoid memory leaks. However, we would like to try
+    // to reuse an existing wrapper as it may have properties set on the JS
+    // side.
+    GinJavaBridgeObject* object = objects_.Lookup(iter->second);
+    bool wrapper_created = false;
+    if (object) {

[jochen (gone - plz use gerrit), 2014/05/05 10:55:49]

I'm not sure I understand this. InjectExisting will create a new wrapper, so you
don't get the properties.

Also, the CreateHandle() call will take ownership of the object - if you call
CreateHandle() multiple times, you'll end up with double-free and use-after-free
behavior

[mnaganov (inactive), 2014/05/06 10:54:15]

This is my understanding of how this works, please correct me if I'm wrong.

WrappableBase holds a persistent weak handle to V8 wrapper object, and it
destroys itself when it gets notified that the wrapper object has been
collected.

When one calls gin::CreateHandle, this comes down to
WrappableBase::GetWrapperImpl, which on the first call creates the V8 wrapper
object and creates a weak handle, and on subsequent calls simply creates a local
V8 handle from the persistent weak one WrappableBase holds.

Since gin::Handle is just a thin wrapper over V8's handle, and it doesn't take
ownership of the Wrappable subclass, calling CreateHandle multiple times on the
same Wrappable child simply creates new a V8 local handle each time. So I'm not
sure, how a double-free scenario can be achieved.

Now, returning to the situation that I handle in this method.
DidClearWindowObject is called on a page reload, which means, all references to
the V8 wrapper object inside V8 get dropped, and the wrapper can be collected,
if a round of GC happens after the reload. In that case, however,
GinJavaBridgeObject will be destroyed by WrappableBase, and the former will
remove itself from |objects_|. This case is handled by the 'else' clause.

But if GC didn't happen after the reload, the V8 wrapper is still alive (but
have no references inside V8), so we simply re-bind it under the same name to
the 'window' object. This situation actually happens when I'm running unit
tests.

+      wrapper_created = GinJavaBridgeObject::InjectExisting(
+          render_frame()->GetWebFrame(),
+          object,
+          iter->first);
+    } else {
+      object = GinJavaBridgeObject::Inject(render_frame()->GetWebFrame(),
+                                           AsWeakPtr(),
+                                           iter->first,
+                                           iter->second);
+      if (object) {
+        wrapper_created = true;
+        objects_.AddWithID(object, iter->second);
+      }
+    }
+    if (!wrapper_created) {
+      // Inform the host about wrapper creation failure.
+      render_frame()->Send(new GinJavaBridgeHostMsg_ObjectWrapperDeleted(
+          routing_id(), iter->second));
+    }
+  }
+}
+
+void GinJavaBridgeDispatcher::OnAddNamedObject(
+    const std::string& name,
+    ObjectID object_id) {
+  // Added objects only become available after page reload, so here they
+  // are only added into the internal map.
+  named_objects_.insert(std::make_pair(name, object_id));
+}
+
+void GinJavaBridgeDispatcher::OnRemoveNamedObject(const std::string& name) {
+  // Removal becomes in effect on next reload. We simply removing the entry
+  // from the map here.
+  NamedObjectMap::iterator iter = named_objects_.find(name);
+  DCHECK(iter != named_objects_.end());
+  named_objects_.erase(iter);
+}
+
+void GinJavaBridgeDispatcher::GetJavaMethods(
+    ObjectID object_id,
+    std::set<std::string>* methods) {
+  render_frame()->Send(new GinJavaBridgeHostMsg_GetMethods(
+      routing_id(), object_id, methods));
+}
+
+bool GinJavaBridgeDispatcher::HasJavaMethod(ObjectID object_id,
+                                            const std::string& method_name) {
+  bool result;
+  render_frame()->Send(new GinJavaBridgeHostMsg_HasMethod(
+      routing_id(), object_id, method_name, &result));
+  return result;
+}
+
+scoped_ptr<base::Value> GinJavaBridgeDispatcher::InvokeJavaMethod(
+    ObjectID object_id,
+    const std::string& method_name,
+    const base::ListValue& arguments) {
+  base::ListValue result_wrapper;
+  render_frame()->Send(
+      new GinJavaBridgeHostMsg_InvokeMethod(routing_id(),
+                                            object_id,
+                                            method_name,
+                                            arguments,
+                                            &result_wrapper));
+  base::Value* result;
+  if (result_wrapper.Get(0, &result)) {
+    return scoped_ptr<base::Value>(result->DeepCopy());
+  } else {
+    return scoped_ptr<base::Value>();
+  }
+}
+
+GinJavaBridgeObject* GinJavaBridgeDispatcher::GetObject(ObjectID object_id) {
+  GinJavaBridgeObject* result = objects_.Lookup(object_id);
+  if (!result) {
+    result = GinJavaBridgeObject::InjectAnonymous(AsWeakPtr(), object_id);
+    if (result)
+      objects_.AddWithID(result, object_id);
+  }
+  return result;
+}
+
+void GinJavaBridgeDispatcher::OnGinJavaBridgeObjectDeleted(ObjectID object_id) {
+  if (!objects_.Lookup(object_id))
+    return;
+  objects_.Remove(object_id);
+  render_frame()->Send(
+      new GinJavaBridgeHostMsg_ObjectWrapperDeleted(routing_id(), object_id));
+}
+
+}  // namespace content