Fixes Issues #5751 & #22631: NPObject identity

content/plugin/npobject_proxy.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/plugin/npobject_proxy.h"
 
 #include "content/common/plugin_messages.h"
 #include "content/plugin/npobject_util.h"
 #include "content/plugin/plugin_channel.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebBindings.h"
@@ skipping 51 matching lines @@
     : channel_(channel),
       route_id_(route_id),
       containing_window_(containing_window),
       page_url_(page_url) {
   channel_->AddRoute(route_id, this, this);
 }
 
 NPObjectProxy::~NPObjectProxy() {
   if (channel_.get()) {
     Send(new NPObjectMsg_Release(route_id_));
-    if (channel_.get())
+    if (channel_.get()) {
       channel_->RemoveRoute(route_id_);
+      channel_->RemoveMappingForNPObjectProxy(route_id_);
+    }
   }
 }
 
 NPObject* NPObjectProxy::Create(PluginChannelBase* channel,
                                 int route_id,
                                 gfx::NativeViewId containing_window,
                                 const GURL& page_url) {
   NPObjectWrapper* obj = reinterpret_cast<NPObjectWrapper*>(
       WebBindings::createObject(0, &npclass_proxy_));
   obj->proxy = new NPObjectProxy(
       channel, route_id, containing_window, page_url);
-
+  channel->AddMappingForNPObjectProxy(route_id, &obj->object);
   return reinterpret_cast<NPObject*>(obj);
 }
 
 bool NPObjectProxy::Send(IPC::Message* msg) {
   if (channel_.get())
     return channel_->Send(msg);
 
   delete msg;
   return false;
 }
@@ skipping 395 matching lines @@
   proxy->Send(msg);
   // Send may delete proxy.
   proxy = NULL;
   if (!result)
     return false;
 
   CreateNPVariant(
       result_param, channel.get(), result_var, containing_window, page_url);
   return true;
 }