2 files changed, 14 insertions, 4 deletions
diff --git a/chromium/content/browser/android/java/gin_java_bridge_dispatcher_host.cc b/chromium/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
index df359f8c122..e1e9597a09d 100644
--- a/chromium/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
+++ b/chromium/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
@@ -11,6 +11,7 @@
 #include "content/browser/android/java/gin_java_bound_object_delegate.h"
 #include "content/browser/android/java/gin_java_bridge_message_filter.h"
 #include "content/browser/android/java/java_bridge_thread.h"
+#include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/android/gin_java_bridge_value.h"
 #include "content/common/android/hash_set.h"
 #include "content/common/gin_java_bridge_messages.h"
@@ -208,7 +209,12 @@ void GinJavaBridgeDispatcherHost::AddNamedObject(
   // notified the observers about new RenderFrame, it is necessary to ensure
   // here that all render frame IDs are registered with the filter.
   InstallFilterAndRegisterAllRoutingIds();
-  web_contents()->SendToAllFrames(
+  // We should include pending RenderFrameHosts, otherwise they will miss the
+  // chance when calling add or remove methods when they are created but not
+  // committed. See: http://crbug.com/1087806
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(web_contents());
+  web_contents_impl->SendToAllFramesIncludingPending(
       new GinJavaBridgeMsg_AddNamedObject(MSG_ROUTING_NONE, name, object_id));
 }
 
@@ -234,7 +240,12 @@ void GinJavaBridgeDispatcherHost::RemoveNamedObject(
   // hold it. All the transient objects and removed named objects will be purged
   // during the cleansing caused by DocumentAvailableInMainFrame event.
 
-  web_contents()->SendToAllFrames(
+  // We should include pending RenderFrameHosts, otherwise they will miss the
+  // chance when calling add or remove methods when they are created but not
+  // committed. See: http://crbug.com/1087806
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(web_contents());
+  web_contents_impl->SendToAllFramesIncludingPending(
       new GinJavaBridgeMsg_RemoveNamedObject(MSG_ROUTING_NONE, copied_name));
 }
 
diff --git a/chromium/content/browser/android/java/gin_java_bridge_message_filter.cc b/chromium/content/browser/android/java/gin_java_bridge_message_filter.cc
index 53dba1f9e84..f16d73b4ec7 100644
--- a/chromium/content/browser/android/java/gin_java_bridge_message_filter.cc
+++ b/chromium/content/browser/android/java/gin_java_bridge_message_filter.cc
@@ -5,7 +5,6 @@
 #include "content/browser/android/java/gin_java_bridge_message_filter.h"
 
 #include "base/auto_reset.h"
-#include "base/task/post_task.h"
 #include "build/build_config.h"
 #include "content/browser/android/java/gin_java_bridge_dispatcher_host.h"
 #include "content/browser/android/java/java_bridge_thread.h"
@@ -40,7 +39,7 @@ void GinJavaBridgeMessageFilter::OnDestruct() const {
   if (BrowserThread::CurrentlyOn(BrowserThread::UI)) {
     delete this;
   } else {
-    base::DeleteSoon(FROM_HERE, {BrowserThread::UI}, this);
+    GetUIThreadTaskRunner({})->DeleteSoon(FROM_HERE, this);
   }
 }