[Android Java Bridge] Recycle old V8 wrapper objects on navigations

content/renderer/java/java_bridge_dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/java/java_bridge_dispatcher.h"
 
 #include "content/child/child_process.h"
 #include "content/child/npapi/npobject_util.h"  // For CreateNPVariant()
 #include "content/common/java_bridge_messages.h"
 #include "content/public/renderer/render_frame.h"
@@ skipping 39 matching lines @@
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
 void JavaBridgeDispatcher::DidClearWindowObject() {
   // Note that we have to (re)bind all objects, as they will have been unbound
   // when the window object was cleared.
   for (ObjectMap::const_iterator iter = objects_.begin();
        iter != objects_.end();
        ++iter) {
+    NPObject* object = NPVARIANT_TO_OBJECT(iter->second);
+    // De-associate from the existing V8 wrapper, so we don't pull any
+    // of the wrapper's custom properties into the context of the page we
+    // have navigated to.
+    blink::WebBindings::dropV8WrapperForObject(object);
     // This refs the NPObject. This reference is dropped when either the window
     // object is later cleared, or the object is GC'ed. So the object may be
     // deleted at any time after OnRemoveNamedObject() is called.
-    render_frame()->GetWebFrame()->bindToWindowObject(
-        iter->first, NPVARIANT_TO_OBJECT(iter->second));
+    render_frame()->GetWebFrame()->bindToWindowObject(iter->first, object);
   }
 }
 
 void JavaBridgeDispatcher::OnAddNamedObject(
     const base::string16& name,
     const NPVariant_Param& variant_param) {
   DCHECK_EQ(variant_param.type, NPVARIANT_PARAM_SENDER_OBJECT_ROUTING_ID);
 
   EnsureChannelIsSetUp();
   if (!channel_.get()) {
@@ skipping 30 matching lines @@
   // Removing an object does not unbind it from JavaScript until the window
   // object is next cleared. Note that the browser checks that the named object
   // is present.
   ObjectMap::iterator iter = objects_.find(name);
   DCHECK(iter != objects_.end());
   blink::WebBindings::releaseObject(NPVARIANT_TO_OBJECT(iter->second));
   objects_.erase(iter);
 }
 
 }  // namespace content