[Android Java Bridge] Recycle old V8 wrapper objects on navigations

content/renderer/java/java_bridge_dispatcher.cc

Index: content/renderer/java/java_bridge_dispatcher.cc
diff --git a/content/renderer/java/java_bridge_dispatcher.cc b/content/renderer/java/java_bridge_dispatcher.cc
index f66bac3d9a290b4a358073edaf21c6f60d18f674..262ea94fbd5f128a624e480fef49c7e6062cb72d 100644
--- a/content/renderer/java/java_bridge_dispatcher.cc
+++ b/content/renderer/java/java_bridge_dispatcher.cc
@@ -57,11 +57,15 @@ void JavaBridgeDispatcher::DidClearWindowObject() {
   for (ObjectMap::const_iterator iter = objects_.begin();
        iter != objects_.end();
        ++iter) {
+    NPObject* object = NPVARIANT_TO_OBJECT(iter->second);
+    // De-associate from the existing V8 wrapper, so we don't pull any
+    // of the wrapper's custom properties into the context of the page we
+    // have navigated to.
+    blink::WebBindings::dropV8WrapperForObject(object);
     // This refs the NPObject. This reference is dropped when either the window
     // object is later cleared, or the object is GC'ed. So the object may be
     // deleted at any time after OnRemoveNamedObject() is called.
-    render_frame()->GetWebFrame()->bindToWindowObject(
-        iter->first, NPVARIANT_TO_OBJECT(iter->second));
+    render_frame()->GetWebFrame()->bindToWindowObject(iter->first, object);
   }
 }