Fixes bug in GinJavaBridgeDispatcherHost

content/browser/android/java/gin_java_bridge_dispatcher_host.cc

Index: content/browser/android/java/gin_java_bridge_dispatcher_host.cc
diff --git a/content/browser/android/java/gin_java_bridge_dispatcher_host.cc b/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
index 65263812a549ccffb39007b448c113629e8375d3..74ccaa21aaf6b0352edd3d971c6d1630524292ae 100644
--- a/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
+++ b/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
@@ -192,6 +192,10 @@ void GinJavaBridgeDispatcherHost::RemoveNamedObject(
   if (iter == named_objects_.end())
     return;
 
+  // |name| may come from |named_objects_|. Make a copy of name so that if
+  // |name| is from |named_objects_| it'll be valid after the remove below.
+  const std::string copied_name(name);
+
   scoped_refptr<GinJavaBoundObject> object(*objects_.Lookup(iter->second));
   named_objects_.erase(iter);
   object->RemoveName();
@@ -210,7 +214,7 @@ void GinJavaBridgeDispatcherHost::RemoveNamedObject(
   }
 
   web_contents()->SendToAllFrames(
-      new GinJavaBridgeMsg_RemoveNamedObject(MSG_ROUTING_NONE, name));
+      new GinJavaBridgeMsg_RemoveNamedObject(MSG_ROUTING_NONE, copied_name));
 }
 
 void GinJavaBridgeDispatcherHost::SetAllowObjectContentsInspection(bool allow) {