[Android] Fix transient objects attribution issue in Java Bridge
RenderFrames must not be accounted as "owners" of injected Java object,
because a wrapper created in one frame can end up being holded by
another frame. Only the lifetime of the corresponding JavaScript wrapper
can influence the lifetime of the injected object.
Thus, remove the code that disposes injected Java object on RenderFrame
deletion. All the disposals are now commenced via OnObjectWrapperDeleted.
There is one caveat -- a RenderFrame can cease to exist before
the wrapper object. Thus, a wrapper may need to report its deletion
not via GinJavaBridgeDispatcher, but rather via RenderThread. It can
still use the routing id of the deleted RenderFrame, as Java Bridge
messages get intercepted by a browser filter, and the routing ids are
just used for wrapper identification.
BUG=486245
Review URL: https://codereview.chromium.org/1225223003
Cr-Commit-Position: refs/heads/master@{#338787}
4 files changed
