Revert 170694 (requested by acleung on irc, breaks content tests on linux)

> Make sure Java Bridge cleans up all stub object it creates.
> 
> I have been trying to see why the JavaBridgeChannelHost, which is reference counted, sticks around forever.
> 
> Here is what I found:
> 
> When talk back is enabled. Each JavaBridgeChannelHost typically have 5 references to it. 3 of them should be cleaned up by this patch. (see comments in the .cc file)
> 
> BUG=157699
> 
> 
> Review URL: https://chromiumcodereview.appspot.com/11359143

TBR=acleung@google.com
Review URL: https://codereview.chromium.org/11412297

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@170699 0039d316-1c4b-4281-b951-d872f2087c98

content/browser/renderer_host/java/java_bridge_dispatcher_host.cc

@@ -29,15 +29,6 @@ class JavaBridgeThread : public base::Thread {
     Stop();
   }
 };
-
-void CleanUpStubs(const std::vector<base::WeakPtr<NPObjectStub> > & stubs) {
-  for (size_t i = 0; i < stubs.size(); ++i) {
-    if (stubs[i]) {
-      stubs[i]->DeleteSoon();
-    }
-  }
-}
-
 base::LazyInstance<JavaBridgeThread> g_background_thread =
     LAZY_INSTANCE_INITIALIZER;
 }  // namespace
@@ -49,9 +40,6 @@ JavaBridgeDispatcherHost::JavaBridgeDispatcherHost(
 }
 
 JavaBridgeDispatcherHost::~JavaBridgeDispatcherHost() {
-  g_background_thread.Get().message_loop()->PostTask(
-      FROM_HERE,
-      base::Bind(&CleanUpStubs, stubs_));
 }
 
 void JavaBridgeDispatcherHost::AddNamedObject(const string16& name,
@@ -145,19 +133,13 @@ void JavaBridgeDispatcherHost::CreateObjectStub(NPObject* object,
         BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO));
   }
 
-  // In a typical scenario, the lifetime of each NPObjectStub is governed by
-  // that of the NPObjectProxy in the renderer, via the channel. However,
-  // we cannot guaranteed that the renderer always terminates cleanly
-  // (crashes / sometimes just unavoidable). We keep a weak reference to
-  // it now and schedule a delete on it when this host is getting deleted.
-
+  // NPObjectStub takes a ref to the NPObject. The lifetime of the NPObjectStub
+  // is governed by that of the NPObjectProxy in the renderer, via the channel.
   // Pass 0 for the containing window, as it's only used by plugins to pump the
   // window message queue when a method on a renderer-side object causes a
   // dialog to be displayed, and the Java Bridge does not need this
   // functionality. The page URL is also not required.
-  stubs_.push_back(
-      (new NPObjectStub(object, channel_, route_id, 0, GURL()))->AsWeakPtr());
-
+  new NPObjectStub(object, channel_, route_id, 0, GURL());
   // The NPObjectStub takes a reference to the NPObject. Release the ref added
   // in CreateNPVariantParam().
   WebKit::WebBindings::releaseObject(object);

content/browser/renderer_host/java/java_bridge_dispatcher_host.h

@@ -5,11 +5,8 @@
 #ifndef CONTENT_BROWSER_RENDERER_HOST_JAVA_JAVA_BRIDGE_DISPATCHER_HOST_H_
 #define CONTENT_BROWSER_RENDERER_HOST_JAVA_JAVA_BRIDGE_DISPATCHER_HOST_H_
 
-#include <vector>
 #include "base/memory/ref_counted.h"
-#include "base/memory/weak_ptr.h"
 #include "base/string16.h"
-#include "content/common/npobject_stub.h"
 #include "content/public/browser/render_view_host_observer.h"
 
 class RouteIDGenerator;
@@ -65,7 +62,6 @@ class JavaBridgeDispatcherHost
 
   scoped_refptr<NPChannelBase> channel_;
   bool is_renderer_initialized_;
-  std::vector<base::WeakPtr<NPObjectStub> > stubs_;
 
   DISALLOW_COPY_AND_ASSIGN(JavaBridgeDispatcherHost);
 };