5 files changed, 272 insertions, 0 deletions
diff --git a/chromium/content/renderer/java/OWNERS b/chromium/content/renderer/java/OWNERS
new file mode 100644
index 00000000000..4b297c43ee6
--- /dev/null
+++ b/chromium/content/renderer/java/OWNERS
@@ -0,0 +1,2 @@
+joth@chromium.org
+steveblock@chromium.org
diff --git a/chromium/content/renderer/java/java_bridge_channel.cc b/chromium/content/renderer/java/java_bridge_channel.cc
new file mode 100644
index 00000000000..235425ab4ff
--- /dev/null
+++ b/chromium/content/renderer/java/java_bridge_channel.cc
@@ -0,0 +1,63 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/java/java_bridge_channel.h"
+
+#include "content/child/child_process.h"
+#include "content/child/plugin_messages.h"
+#include "content/common/java_bridge_messages.h"
+#include "third_party/WebKit/public/web/WebBindings.h"
+
+namespace content {
+
+JavaBridgeChannel* JavaBridgeChannel::GetJavaBridgeChannel(
+    const IPC::ChannelHandle& channel_handle,
+    base::MessageLoopProxy* ipc_message_loop) {
+  return static_cast<JavaBridgeChannel*>(NPChannelBase::GetChannel(
+      channel_handle,
+      IPC::Channel::MODE_CLIENT,
+      ClassFactory,
+      ipc_message_loop,
+      true,
+      ChildProcess::current()->GetShutDownEvent()));
+}
+
+JavaBridgeChannel::JavaBridgeChannel()
+    : peer_owner_id_(new struct _NPP) {
+  // Register the dummy owner Id for our peer (the Browser process) as an object
+  // owner, and have all objects received from the peer owned by it.
+  WebKit::WebBindings::registerObjectOwner(peer_owner_id_.get());
+  SetDefaultNPObjectOwner(peer_owner_id_.get());
+}
+
+JavaBridgeChannel::~JavaBridgeChannel() {
+  WebKit::WebBindings::unregisterObjectOwner(peer_owner_id_.get());
+}
+
+int JavaBridgeChannel::GenerateRouteID() {
+  // Use a control message as this going to the JavaBridgeChannelHost, not an
+  // injected object.
+  int route_id = MSG_ROUTING_NONE;
+  Send(new JavaBridgeMsg_GenerateRouteID(&route_id));
+  // This should never fail, as the JavaBridgeChannelHost should always outlive
+  // us.
+  DCHECK_NE(MSG_ROUTING_NONE, route_id);
+  return route_id;
+}
+
+bool JavaBridgeChannel::OnControlMessageReceived(const IPC::Message& msg) {
+  // We need to intercept these two message types because the default
+  // implementation of NPChannelBase::OnControlMessageReceived() is to
+  // DCHECK(false). However, we don't need to do anything, as we don't need to
+  // worry about the window system hanging when a modal dialog is displayed.
+  // This is because, unlike in the case of plugins, the host does not need to
+  // pump the message queue to avoid hangs.
+  if (msg.type() == PluginMsg_SignalModalDialogEvent::ID ||
+      msg.type() == PluginMsg_ResetModalDialogEvent::ID) {
+    return true;
+  }
+  return NPChannelBase::OnControlMessageReceived(msg);
+}
+
+}  // namespace content
diff --git a/chromium/content/renderer/java/java_bridge_channel.h b/chromium/content/renderer/java/java_bridge_channel.h
new file mode 100644
index 00000000000..a947374cefe
--- /dev/null
+++ b/chromium/content/renderer/java/java_bridge_channel.h
@@ -0,0 +1,43 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_JAVA_JAVA_BRIDGE_CHANNEL_H_
+#define CONTENT_RENDERER_JAVA_JAVA_BRIDGE_CHANNEL_H_
+
+#include "base/memory/scoped_ptr.h"
+#include "content/child/npapi/np_channel_base.h"
+#include "ipc/ipc_channel_handle.h"
+
+namespace content {
+
+class JavaBridgeChannel : public content::NPChannelBase {
+ public:
+  // The return value may be null.
+  static JavaBridgeChannel* GetJavaBridgeChannel(
+      const IPC::ChannelHandle& channel_handle,
+      base::MessageLoopProxy* ipc_message_loop);
+
+  // NPChannelBase implementation:
+  virtual int GenerateRouteID() OVERRIDE;
+
+  // NPChannelBase override:
+  virtual bool OnControlMessageReceived(const IPC::Message& msg) OVERRIDE;
+
+ private:
+  JavaBridgeChannel();
+  // This class is ref-counted.
+  virtual ~JavaBridgeChannel();
+
+  static NPChannelBase* ClassFactory() { return new JavaBridgeChannel(); }
+
+  // Dummy NPObject owner Id used to track objects owned by the JavaBridge
+  // peer in the Browser process.
+  scoped_ptr<struct _NPP> peer_owner_id_;
+
+  DISALLOW_COPY_AND_ASSIGN(JavaBridgeChannel);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_JAVA_JAVA_BRIDGE_CHANNEL_H_
diff --git a/chromium/content/renderer/java/java_bridge_dispatcher.cc b/chromium/content/renderer/java/java_bridge_dispatcher.cc
new file mode 100644
index 00000000000..376ecb1e481
--- /dev/null
+++ b/chromium/content/renderer/java/java_bridge_dispatcher.cc
@@ -0,0 +1,113 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/java/java_bridge_dispatcher.h"
+
+#include "content/child/child_process.h"
+#include "content/child/npapi/npobject_util.h"  // For CreateNPVariant()
+#include "content/common/java_bridge_messages.h"
+#include "content/public/renderer/render_thread.h"
+#include "content/public/renderer/render_view.h"
+#include "content/renderer/java/java_bridge_channel.h"
+#include "third_party/WebKit/public/web/WebBindings.h"
+#include "third_party/WebKit/public/web/WebDocument.h"
+#include "third_party/WebKit/public/web/WebFrame.h"
+#include "third_party/WebKit/public/web/WebView.h"
+
+namespace content {
+
+JavaBridgeDispatcher::JavaBridgeDispatcher(RenderView* render_view)
+    : RenderViewObserver(render_view) {
+}
+
+void JavaBridgeDispatcher::EnsureChannelIsSetUp() {
+  if (channel_.get()) {
+    return;
+  }
+
+  IPC::ChannelHandle channel_handle;
+  Send(new JavaBridgeHostMsg_GetChannelHandle(routing_id(), &channel_handle));
+
+  channel_ = JavaBridgeChannel::GetJavaBridgeChannel(
+      channel_handle, ChildProcess::current()->io_message_loop_proxy());
+}
+
+JavaBridgeDispatcher::~JavaBridgeDispatcher() {
+  for (ObjectMap::const_iterator iter = objects_.begin();
+      iter != objects_.end(); ++iter) {
+    WebKit::WebBindings::releaseObject(NPVARIANT_TO_OBJECT(iter->second));
+  }
+}
+
+bool JavaBridgeDispatcher::OnMessageReceived(const IPC::Message& msg) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(JavaBridgeDispatcher, msg)
+    IPC_MESSAGE_HANDLER(JavaBridgeMsg_AddNamedObject, OnAddNamedObject)
+    IPC_MESSAGE_HANDLER(JavaBridgeMsg_RemoveNamedObject,
+                        OnRemoveNamedObject)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  return handled;
+}
+
+void JavaBridgeDispatcher::DidClearWindowObject(WebKit::WebFrame* web_frame) {
+  // Note that we have to (re)bind all objects, as they will have been unbound
+  // when the window object was cleared.
+  for (ObjectMap::const_iterator iter = objects_.begin();
+      iter != objects_.end(); ++iter) {
+    // This refs the NPObject. This reference is dropped when either the window
+    // object is later cleared, or the object is GC'ed. So the object may be
+    // deleted at any time after OnRemoveNamedObject() is called.
+    web_frame->bindToWindowObject(iter->first,
+        NPVARIANT_TO_OBJECT(iter->second));
+  }
+}
+
+void JavaBridgeDispatcher::OnAddNamedObject(
+    const string16& name,
+    const NPVariant_Param& variant_param) {
+  DCHECK_EQ(variant_param.type, NPVARIANT_PARAM_SENDER_OBJECT_ROUTING_ID);
+
+  EnsureChannelIsSetUp();
+  if (!channel_.get()) {
+    // It's possible for |channel_| to be NULL if the RenderView is going away.
+    return;
+  }
+
+  // This creates an NPObject, wrapped as an NPVariant. Pass 0 for the for
+  // containing window, as this is only used by plugins to pump the window
+  // message queue when a method on a renderer-side object causes a dialog to
+  // be displayed, and the Java Bridge does not need this functionality. The
+  // page URL is also not required.
+  NPVariant variant;
+  bool created =
+      CreateNPVariant(variant_param, channel_.get(), &variant, 0, GURL());
+  DCHECK(created);
+  DCHECK_EQ(variant.type, NPVariantType_Object);
+
+  // The NPObject is created with a ref count of one, which we remove when
+  // OnRemoveNamedObject() is called for that object.
+  ObjectMap::iterator iter = objects_.find(name);
+  if (iter != objects_.end()) {
+    WebKit::WebBindings::releaseObject(NPVARIANT_TO_OBJECT(iter->second));
+  }
+  objects_[name] = variant;
+}
+
+void JavaBridgeDispatcher::OnRemoveNamedObject(const string16& name) {
+  if (!channel_.get()) {
+    DCHECK(objects_.empty());
+    return;
+  }
+
+  // Removing an object does not unbind it from JavaScript until the window
+  // object is next cleared. Note that the browser checks that the named object
+  // is present.
+  ObjectMap::iterator iter = objects_.find(name);
+  DCHECK(iter != objects_.end());
+  WebKit::WebBindings::releaseObject(NPVARIANT_TO_OBJECT(iter->second));
+  objects_.erase(iter);
+}
+
+}  // namespace content
diff --git a/chromium/content/renderer/java/java_bridge_dispatcher.h b/chromium/content/renderer/java/java_bridge_dispatcher.h
new file mode 100644
index 00000000000..29a10374590
--- /dev/null
+++ b/chromium/content/renderer/java/java_bridge_dispatcher.h
@@ -0,0 +1,51 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_JAVA_JAVA_BRIDGE_DISPATCHER_H_
+#define CONTENT_RENDERER_JAVA_JAVA_BRIDGE_DISPATCHER_H_
+
+#include <map>
+
+#include "base/memory/ref_counted.h"
+#include "content/public/renderer/render_view_observer.h"
+#include "ipc/ipc_channel_handle.h"
+#include "third_party/npapi/bindings/npruntime.h"
+
+namespace content {
+class JavaBridgeChannel;
+struct NPVariant_Param;
+
+// This class handles injecting Java objects into the main frame of a
+// RenderView. The 'add' and 'remove' messages received from the browser
+// process modify the entries in a map of 'pending' objects. These objects are
+// bound to the window object of the main frame when that window object is next
+// cleared. These objects remain bound until the window object is cleared
+// again.
+class JavaBridgeDispatcher : public RenderViewObserver {
+ public:
+  JavaBridgeDispatcher(RenderView* render_view);
+  virtual ~JavaBridgeDispatcher();
+
+ private:
+  // RenderViewObserver override:
+  virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
+  virtual void DidClearWindowObject(WebKit::WebFrame* frame) OVERRIDE;
+
+  // Message handlers
+  void OnAddNamedObject(const string16& name,
+                        const NPVariant_Param& variant_param);
+  void OnRemoveNamedObject(const string16& name);
+
+  void EnsureChannelIsSetUp();
+
+  // Objects that will be bound to the window when the window object is next
+  // cleared. We hold a ref to these.
+  typedef std::map<string16, NPVariant> ObjectMap;
+  ObjectMap objects_;
+  scoped_refptr<JavaBridgeChannel> channel_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_JAVA_JAVA_BRIDGE_DISPATCHER_H_