Fixes bug in GinJavaBridgeDispatcherHost

content/browser/android/java/gin_java_bridge_dispatcher_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/android/java/gin_java_bridge_dispatcher_host.h"
 
 #include "base/android/java_handler_thread.h"
 #include "base/android/jni_android.h"
 #include "base/android/scoped_java_ref.h"
 #include "base/lazy_instance.h"
@@ skipping 174 matching lines @@
       new GinJavaBridgeMsg_AddNamedObject(MSG_ROUTING_NONE, name, object_id));
 }
 
 void GinJavaBridgeDispatcherHost::RemoveNamedObject(
     const std::string& name) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   NamedObjectMap::iterator iter = named_objects_.find(name);
   if (iter == named_objects_.end())
     return;
 
+  // |name| may come from |named_objects_|. Make a copy of name so that if
+  // |name| is from |named_objects_| it'll be valid after the remove below.
+  const std::string copied_name(name);
+
   scoped_refptr<GinJavaBoundObject> object(*objects_.Lookup(iter->second));
   named_objects_.erase(iter);
   object->RemoveName();
 
   // Not erasing from the objects map, as we can still receive method
   // invocation requests for this object, and they should work until the
   // java object is gone.
   if (!object->IsNamed()) {
     JNIEnv* env = base::android::AttachCurrentThread();
     base::android::ScopedJavaLocalRef<jobject> retained_object_set =
         retained_object_set_.get(env);
     if (!retained_object_set.is_null()) {
       JNI_Java_HashSet_remove(
           env, retained_object_set, object->GetLocalRef(env));
     }
   }
 
   web_contents()->SendToAllFrames(
-      new GinJavaBridgeMsg_RemoveNamedObject(MSG_ROUTING_NONE, name));
+      new GinJavaBridgeMsg_RemoveNamedObject(MSG_ROUTING_NONE, copied_name));
 }
 
 void GinJavaBridgeDispatcherHost::SetAllowObjectContentsInspection(bool allow) {
   allow_object_contents_inspection_ = allow;
 }
 
 void GinJavaBridgeDispatcherHost::DocumentAvailableInMainFrame() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // Called when the window object has been cleared in the main frame.
   // That means, all sub-frames have also been cleared, so only named
@@ skipping 293 matching lines @@
   if (objects_.Lookup(object_id)) {
     GinJavaBoundObject::ObjectMap::iterator iter(&objects_);
     while (!iter.IsAtEnd() && iter.GetCurrentKey() != object_id)
       iter.Advance();
     DCHECK(!iter.IsAtEnd());
     RemoveHolder(render_frame_host, iter, 1);
   }
 }
 
 }  // namespace content