Fixes Issues #5751 & #22631: NPObject identity

content/plugin/npobject_stub.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/plugin/npobject_stub.h"
 
 #include "content/common/content_client.h"
 #include "content/common/plugin_messages.h"
 #include "content/plugin/npobject_util.h"
 #include "content/plugin/plugin_channel_base.h"
 #include "content/plugin/plugin_thread.h"
 #include "third_party/npapi/bindings/npapi.h"
 #include "third_party/npapi/bindings/npruntime.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebBindings.h"
 #include "webkit/plugins/npapi/plugin_constants_win.h"
 
 using WebKit::WebBindings;
 
 NPObjectStub::NPObjectStub(
     NPObject* npobject,
     PluginChannelBase* channel,
     int route_id,
     gfx::NativeViewId containing_window,
     const GURL& page_url)
     : npobject_(npobject),
       channel_(channel),
       route_id_(route_id),
       containing_window_(containing_window),
       page_url_(page_url) {
+  channel_->AddMappingForNPObjectStub(route_id, npobject);
   channel_->AddRoute(route_id, this, this);
 
   // We retain the object just as PluginHost does if everything was in-process.
   WebBindings::retainObject(npobject_);
 }
 
 NPObjectStub::~NPObjectStub() {
   channel_->RemoveRoute(route_id_);
-  if (npobject_)
+  if (npobject_) {
+    channel_->RemoveMappingForNPObjectStub(route_id_, npobject_);
     WebBindings::releaseObject(npobject_);
+  }
 }
 
 bool NPObjectStub::Send(IPC::Message* msg) {
   return channel_->Send(msg);
 }
 
 void NPObjectStub::OnPluginDestroyed() {
+  channel_->RemoveMappingForNPObjectStub(route_id_, npobject_);
   // We null out the underlying NPObject pointer since it's not valid anymore (
   // ScriptController manually deleted the object).  As a result,
   // OnMessageReceived won't dispatch any more messages.  Since this includes
   // OnRelease, this object won't get deleted until OnChannelError which might
   // not happen for a long time if this renderer process has a long lived
   // plugin instance to the same process.  So we delete this object manually.
   npobject_ = NULL;
   MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
@@ skipping 336 matching lines @@
   bool return_value = WebBindings::evaluateHelper(0, popups_allowed, npobject_,
                                                   &script_string, &result_var);
 
   NPVariant_Param result_param;
   CreateNPVariantParam(
       result_var, local_channel, &result_param, true, containing_window_,
       page_url_);
   NPObjectMsg_Evaluate::WriteReplyParams(reply_msg, result_param, return_value);
   local_channel->Send(reply_msg);
 }