Fixes Issues #5751 & #22631: NPObject identity

content/plugin/npobject_util.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/plugin/npobject_util.h"
 
 #include "base/string_util.h"
 #include "content/common/plugin_messages.h"
 #include "content/plugin/npobject_proxy.h"
 #include "content/plugin/plugin_channel_base.h"
@@ skipping 174 matching lines @@
         // Don't release, because our original variant is the same as our proxy.
         release = false;
       } else {
         // The channel could be NULL if there was a channel error. The caller's
         // Send call will fail anyways.
         if (channel) {
           // NPObjectStub adds its own reference to the NPObject it owns, so if
           // we were supposed to release the corresponding variant
           // (release==true), we should still do that.
           param->type = NPVARIANT_PARAM_SENDER_OBJECT_ROUTING_ID;
-          int route_id = channel->GenerateRouteID();
-          new NPObjectStub(
-              variant.value.objectValue, channel, route_id, containing_window,
-              page_url);
-          param->npobject_routing_id = route_id;
+          int route_id = channel->GetExistingRouteForNPObjectStub(
+              variant.value.objectValue);
+          if (route_id != MSG_ROUTING_NONE) {
+            param->npobject_routing_id = route_id;
+          } else {
+            route_id = channel->GenerateRouteID();
+            new NPObjectStub(
+                variant.value.objectValue, channel, route_id,
+                containing_window, page_url);
+            param->npobject_routing_id = route_id;
+          }
         } else {
           param->type = NPVARIANT_PARAM_VOID;
         }
       }
       break;
     }
     default:
       NOTREACHED();
   }
 
   if (release)
     WebBindings::releaseVariantValue(const_cast<NPVariant*>(&variant));
 }
 
 bool CreateNPVariant(const NPVariant_Param& param,
                      PluginChannelBase* channel,
                      NPVariant* result,
                      gfx::NativeViewId containing_window,
                      const GURL& page_url) {
+  NPObject* object = NULL;
   switch (param.type) {
     case NPVARIANT_PARAM_VOID:
       result->type = NPVariantType_Void;
       break;
     case NPVARIANT_PARAM_NULL:
       result->type = NPVariantType_Null;
       break;
     case NPVARIANT_PARAM_BOOL:
       result->type = NPVariantType_Bool;
       result->value.boolValue = param.bool_value;
       break;
     case NPVARIANT_PARAM_INT:
       result->type = NPVariantType_Int32;
       result->value.intValue = param.int_value;
       break;
     case NPVARIANT_PARAM_DOUBLE:
       result->type = NPVariantType_Double;
       result->value.doubleValue = param.double_value;
       break;
     case NPVARIANT_PARAM_STRING:
       result->type = NPVariantType_String;
       result->value.stringValue.UTF8Characters =
           static_cast<NPUTF8 *>(base::strdup(param.string_value.c_str()));
       result->value.stringValue.UTF8Length =
           static_cast<int>(param.string_value.size());
       break;
     case NPVARIANT_PARAM_SENDER_OBJECT_ROUTING_ID:
       result->type = NPVariantType_Object;
-      result->value.objectValue =
-          NPObjectProxy::Create(channel,
-                                param.npobject_routing_id,
-                                containing_window,
-                                page_url);
+      object = channel->GetExistingNPObjectProxy(param.npobject_routing_id);
+      if (object) {
+        WebBindings::retainObject(object);
+        result->value.objectValue = object;
+      } else {
+        result->value.objectValue =
+            object = NPObjectProxy::Create(channel,
+                                           param.npobject_routing_id,
+                                           containing_window,
+                                           page_url);
+        result->value.objectValue = object;
+      }
       break;
     case NPVARIANT_PARAM_RECEIVER_OBJECT_ROUTING_ID: {
       NPObjectBase* npobject_base =
           channel->GetNPObjectListenerForRoute(param.npobject_routing_id);
       if (!npobject_base) {
         DLOG(WARNING) << "Invalid routing id passed in"
                       << param.npobject_routing_id;
         return false;
       }
 
       DCHECK(npobject_base->GetUnderlyingNPObject() != NULL);
 
       result->type = NPVariantType_Object;
       result->value.objectValue = npobject_base->GetUnderlyingNPObject();
       WebBindings::retainObject(result->value.objectValue);
       break;
     }
     default:
       NOTREACHED();
   }
   return true;
 }