<browser>: Always read <browser>.src attribute from <object>.src.

chrome/renderer/resources/extensions/browser_tag.js

Index: chrome/renderer/resources/extensions/browser_tag.js
diff --git a/chrome/renderer/resources/extensions/browser_tag.js b/chrome/renderer/resources/extensions/browser_tag.js
index 3035257e36fbcd20e87a3f4e5f1246b8dba76dce..0f38f32ea4562b533694eab92d69a64278e1978d 100644
--- a/chrome/renderer/resources/extensions/browser_tag.js
+++ b/chrome/renderer/resources/extensions/browser_tag.js
@@ -72,10 +72,17 @@ function BrowserTag(node) {
       this.node_,
       {attributes: true, attributeFilter: BROWSER_TAG_ATTRIBUTES});
 
+  var objectNode = this.objectNode_;
   // Expose getters and setters for the attributes.
   BROWSER_TAG_ATTRIBUTES.forEach(function(attributeName) {
     Object.defineProperty(this.node_, attributeName, {
       get: function() {
+        if (attributeName == 'src') {
+          // Always read src attribute from the plugin <object> since: a) It can
+          // have different value when empty src is set. b) BrowserPlugin
+          // updates its src attribute on guest-initiated navigations.
+          return objectNode.src;
+        }
         var value = node.getAttribute(attributeName);
         var numericValue = parseInt(value, 10);
         return isNaN(numericValue) ? value : numericValue;