Thanks for catching the bug. As a way to address tedchoc@'s comment https://chromium-review.googlesource.com/c/chromium/src/+/828000/2/content/public/android/java/src/org/chromium/content/browser/JavascriptInjectorImpl.java#41, I'm trying to get rid of native WebContentsUserData from JavascriptInjector/GestureListenerManager. Since the only reason they inherit it is to do something at destructor, I think it can be replaced with a logic coming from destruction and handling the WCUD-managed objects.

that's not easy though. that involves using a ReferenceQueue to watch java objects being gc-ed, which we've so far avoided doing in content/ and chrome/

My idea is based on the fact that these native WebContentsUserData-managed objects have the same lifetime as WebContents, so their |destroy| needs to be called as a part of the native WebContents destruction. It doesn't have to be exactly timed with the java object gc. i.e. their destruction won't be initiated by their java object being gc'ed but by the native WebContents destruction, as long as the native destruction precedes the Java counterparts. 

That said, it may be tricky for WebView because the Java objects might be already gc'ed by the time the native WebContents gets destroyed. Maybe WebView could use its own logic calling |destroy|.

I'm not sure what you are trying to say here. Yes webview has its way to ensure native WebContentsImpl is destroyed, so if you want native WebContentsImpl to destroy these other things, then sure, that works. But then that's exactly WebContentsUserData gives you. So that's not really a new design?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e376d0d827d67f26c4c47d01e9ea20f6af5adbff

commit e376d0d827d67f26c4c47d01e9ea20f6af5adbff
Author: Jinsuk Kim <jinsukkim@chromium.org>
Date: Wed Jan 03 01:56:43 2018

Call |SetUserData| for JavascriptInjector

JavascriptInjector in https://crrev.com/c/828000 missed calling
|WebContents::SetUserData|, therefore the newly created instance
is leaked. This CL fixes it.

Bug:  798549 
Change-Id: Ia9c95edcba363f5fc5b8aafaf97cec0ea3dd4759
Reviewed-on: https://chromium-review.googlesource.com/848112
Reviewed-by: Bo <boliu@chromium.org>
Commit-Queue: Jinsuk Kim <jinsukkim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#526580}
[modify] https://crrev.com/e376d0d827d67f26c4c47d01e9ea20f6af5adbff/content/browser/android/javascript_injector.cc