cherry-pick this change from master (should be in honeycomb-mr1) (please don't merge)

Avoid Android modifications to JavaNPObjectV8.cpp/h

https://android-git.corp.google.com/g/40387 fixed a long-standing bug to
avoid leaking references to injected Java objects. However, it did so by
making changes to JavaNPObjectV8.cpp/h which were never upstreamed. This
change avoids the need for these changes.

This change also avoids the use of a local PassRefPtr, which was
incorrectly introduced in https://android-git.corp.google.com/g/36204.

Change-Id: Ia1e3245a953826bbfd8e085f7ed1b1341228255d

1 files changed, 2 insertions, 2 deletions

diff --git a/WebKit/android/jni/WebCoreFrameBridge.cpp b/WebKit/android/jni/WebCoreFrameBridge.cpp
index f800e2d..eff64e1 100644
--- a/WebKit/android/jni/WebCoreFrameBridge.cpp
+++ b/WebKit/android/jni/WebCoreFrameBridge.cpp
@@ -1702,10 +1702,10 @@ static void AddJavascriptInterface(JNIEnv *env, jobject obj, jint nativeFramePoi
     }
 #elif USE(V8)
     if (pFrame) {
-        PassRefPtr<JavaInstance> addedObject = WeakJavaInstance::create(javascriptObj);
+        RefPtr<JavaInstance> addedObject = WeakJavaInstance::create(javascriptObj);
         const char* name = getCharactersFromJStringInEnv(env, interfaceName);
         // Pass ownership of the added object to bindToWindowObject.
-        NPObject* npObject = JavaInstanceToNPObject(addedObject);
+        NPObject* npObject = JavaInstanceToNPObject(addedObject.get());
         pFrame->script()->bindToWindowObject(pFrame, name, npObject);
         // bindToWindowObject calls NPN_RetainObject on the
         // returned one (see createV8ObjectForNPObject in V8NPObject.cpp).