Fix crash in Java Bridge methods that can receive a non-existant object ID

Bug: 18990952
Change-Id: Idc66b18361306f229bfc27642a4f989f60a1a4d3
diff --git a/content/browser/android/java/gin_java_bridge_dispatcher_host.cc b/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
index ca63276..73649f1 100644
--- a/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
+++ b/content/browser/android/java/gin_java_bridge_dispatcher_host.cc
@@ -135,8 +135,7 @@
 
 JavaObjectWeakGlobalRef GinJavaBridgeDispatcherHost::GetObjectWeakRef(
     GinJavaBoundObject::ObjectID object_id) {
-  scoped_refptr<GinJavaBoundObject>* result = objects_.Lookup(object_id);
-  scoped_refptr<GinJavaBoundObject> object(result ? *result : NULL);
+  scoped_refptr<GinJavaBoundObject> object = FindObject(object_id);
   if (object.get())
     return object->GetWeakRef();
   else
@@ -326,6 +325,12 @@
   return handled;
 }
 
+scoped_refptr<GinJavaBoundObject> GinJavaBridgeDispatcherHost::FindObject(
+    GinJavaBoundObject::ObjectID object_id) {
+  scoped_refptr<GinJavaBoundObject>* result_ptr = objects_.Lookup(object_id);
+  return result_ptr ? *result_ptr : NULL;
+}
+
 namespace {
 
 class IsValidRenderFrameHostHelper
@@ -373,7 +378,7 @@
     render_frame_host->Send(reply_msg);
     return;
   }
-  scoped_refptr<GinJavaBoundObject> object(*objects_.Lookup(object_id));
+  scoped_refptr<GinJavaBoundObject> object = FindObject(object_id);
   if (!object) {
     LOG(ERROR) << "WebView: Unknown object: " << object_id;
     IPC::WriteParam(reply_msg, std::set<std::string>());
@@ -409,7 +414,7 @@
     IPC::Message* reply_msg) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(render_frame_host);
-  scoped_refptr<GinJavaBoundObject> object(*objects_.Lookup(object_id));
+  scoped_refptr<GinJavaBoundObject> object = FindObject(object_id);
   if (!object) {
     LOG(ERROR) << "WebView: Unknown object: " << object_id;
     IPC::WriteParam(reply_msg, false);
@@ -446,7 +451,7 @@
     IPC::Message* reply_msg) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(render_frame_host);
-  scoped_refptr<GinJavaBoundObject> object(*objects_.Lookup(object_id));
+  scoped_refptr<GinJavaBoundObject> object = FindObject(object_id);
   if (!object) {
     LOG(ERROR) << "WebView: Unknown object: " << object_id;
     base::ListValue result;
diff --git a/content/browser/android/java/gin_java_bridge_dispatcher_host.h b/content/browser/android/java/gin_java_bridge_dispatcher_host.h
index 48fcbb5..a8bc280 100644
--- a/content/browser/android/java/gin_java_bridge_dispatcher_host.h
+++ b/content/browser/android/java/gin_java_bridge_dispatcher_host.h
@@ -75,6 +75,8 @@
   void OnObjectWrapperDeleted(RenderFrameHost* render_frame_host,
                               GinJavaBoundObject::ObjectID object_id);
 
+  scoped_refptr<GinJavaBoundObject> FindObject(
+      GinJavaBoundObject::ObjectID object_id);
   bool IsValidRenderFrameHost(RenderFrameHost* render_frame_host);
   void SendMethods(RenderFrameHost* render_frame_host,
                    const std::set<std::string>& method_names);