fix memory leak, error message and possible crash in remote object re…

…gistry

auditors: @bbondy
related #6832

atom/common/api/remote_object_freer.cc

@@ -41,14 +41,20 @@ void RemoteObjectFreer::BindTo(
 RemoteObjectFreer::RemoteObjectFreer(
     v8::Isolate* isolate, v8::Local<v8::Object> target, int object_id)
     : ObjectLifeMonitor(isolate, target),
-      object_id_(object_id) {
+      object_id_(object_id),
+      routing_id_(MSG_ROUTING_NONE) {
+  content::RenderView* render_view = GetCurrentRenderView();
+  if (render_view) {
+    routing_id_ = render_view->GetRoutingID();
+  }
 }
 
 RemoteObjectFreer::~RemoteObjectFreer() {
 }
 
 void RemoteObjectFreer::RunDestructor() {
-  content::RenderView* render_view = GetCurrentRenderView();
+  content::RenderView* render_view =
+      content::RenderView::FromRoutingID(routing_id_);
   if (!render_view)
     return;
 

atom/common/api/remote_object_freer.h

@@ -23,6 +23,7 @@ class RemoteObjectFreer : public ObjectLifeMonitor {
 
  private:
   int object_id_;
+  int routing_id_;
 
   DISALLOW_COPY_AND_ASSIGN(RemoteObjectFreer);
 };

lib/browser/objects-registry.js

@@ -41,7 +41,7 @@ class ObjectsRegistry {
 
   // Get an object according to its ID.
   get (id) {
-    return this.storage[id].object
+    return this.storage[id] && this.storage[id].object
   }
 
   // Dereference an object according to its ID.

lib/browser/rpc-server.js

@@ -303,6 +303,10 @@ ipcMain.on('ELECTRON_BROWSER_MEMBER_CALL', function (event, id, method, args) {
   try {
     args = unwrapArgs(event.sender, args)
     let obj = objectsRegistry.get(id)
+    if (!obj) {
+      console.error(`Calling method ${method} with ${args} on WebContents with unknown ID ${id}`)
+      return
+    }
     callFunction(event, obj[method], obj, args)
   } catch (error) {
     event.returnValue = exceptionToMeta(error)