Avoid Android modifications to JavaNPObjectV8.cpp/h

https://android-git.corp.google.com/g/40387 fixed a long-standing bug to
avoid leaking references to injected Java objects. However, it did so by
making changes to JavaNPObjectV8.cpp/h which were never upstreamed. This
change avoids the need for these changes.

This change also avoids the use of a local PassRefPtr, which was
incorrectly introduced in https://android-git.corp.google.com/g/36204.

Change-Id: I6b17e85f7991e5226e00e7b041c38e2ca3d0cf57

diff --git a/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp b/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp
index 7aa55b5..3bb8e27 100644 (file)
--- a/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp
+++ b/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp
@@ -68,9 +68,7 @@ static NPClass JavaNPObjectClass = {
     0 // construct
 };
 
-// ANDROID-specific change. TODO: Upstream
-NPObject* JavaInstanceToNPObject(PassRefPtr<JavaInstance> instance)
-// END ANDROID-specific change
+NPObject* JavaInstanceToNPObject(JavaInstance* instance)
 {
     JavaNPObject* object = reinterpret_cast<JavaNPObject*>(_NPN_CreateObject(0, &JavaNPObjectClass));
     object->m_instance = instance;

diff --git a/WebCore/bridge/jni/v8/JavaNPObjectV8.h b/WebCore/bridge/jni/v8/JavaNPObjectV8.h
index e68a5aa..31b0ac7 100644 (file)
--- a/WebCore/bridge/jni/v8/JavaNPObjectV8.h
+++ b/WebCore/bridge/jni/v8/JavaNPObjectV8.h
@@ -41,9 +41,7 @@ struct JavaNPObject {
     RefPtr<JavaInstance> m_instance;
 };
 
-// ANDROID-specific change. TODO: Upstream
-NPObject* JavaInstanceToNPObject(PassRefPtr<JavaInstance>);
-// END ANDROID-specific change
+NPObject* JavaInstanceToNPObject(JavaInstance*);
 JavaInstance* ExtractJavaInstance(NPObject*);
 
 bool JavaNPObjectHasMethod(NPObject*, NPIdentifier name);

diff --git a/WebKit/android/jni/WebCoreFrameBridge.cpp b/WebKit/android/jni/WebCoreFrameBridge.cpp
index c187d92..e48e406 100644 (file)
--- a/WebKit/android/jni/WebCoreFrameBridge.cpp
+++ b/WebKit/android/jni/WebCoreFrameBridge.cpp
@@ -1699,10 +1699,10 @@ static void AddJavascriptInterface(JNIEnv *env, jobject obj, jint nativeFramePoi
     }
 #elif USE(V8)
     if (pFrame) {
-        PassRefPtr<JavaInstance> addedObject = WeakJavaInstance::create(javascriptObj);
+        RefPtr<JavaInstance> addedObject = WeakJavaInstance::create(javascriptObj);
         const char* name = getCharactersFromJStringInEnv(env, interfaceName);
         // Pass ownership of the added object to bindToWindowObject.
-        NPObject* npObject = JavaInstanceToNPObject(addedObject);
+        NPObject* npObject = JavaInstanceToNPObject(addedObject.get());
         pFrame->script()->bindToWindowObject(pFrame, name, npObject);
         // bindToWindowObject calls NPN_RetainObject on the
         // returned one (see createV8ObjectForNPObject in V8NPObject.cpp).