<browser>: Always read <browser>.src attribute from <object>.src.

chrome/renderer/resources/extensions/browser_tag.js

Index: chrome/renderer/resources/extensions/browser_tag.js
diff --git a/chrome/renderer/resources/extensions/browser_tag.js b/chrome/renderer/resources/extensions/browser_tag.js
index 362ebea154313565dfbf0977853de2ced78ef992..911acca2cfb188dc2217acd1b86cd24e75e21b52 100644
--- a/chrome/renderer/resources/extensions/browser_tag.js
+++ b/chrome/renderer/resources/extensions/browser_tag.js
@@ -51,10 +51,17 @@ function BrowserTag(node) {
       this.node_,
       {attributes: true, attributeFilter: BROWSER_TAG_ATTRIBUTES});
 
+  var objectNode = this.objectNode_;
   // Expose getters and setters for the attributes.
   BROWSER_TAG_ATTRIBUTES.forEach(function(attributeName) {
     Object.defineProperty(this.node_, attributeName, {
       get: function() {
+        if (attributeName == 'src') {
+          // Always read src attribute from the plugin <object> since: a) It can
+          // have different value when empty src is set. b) BrowserPlugin
+          // updates its src attribute on guest-initiated navigations.
+          return objectNode.src;
+        }
         var value = node.getAttribute(attributeName);
         var numericValue = parseInt(value, 10);
         return isNaN(numericValue) ? value : numericValue;