Fix for a memory corruption.

content/browser/tab_contents/render_view_host_manager.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/tab_contents/render_view_host_manager.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "content/browser/content_browser_client.h"
 #include "content/browser/renderer_host/render_view_host.h"
@@ skipping 617 matching lines @@
       Source<NavigationController>(&delegate_->GetControllerForRenderManager()),
       Details<RenderViewHostSwitchedDetails>(&details));
 
   // If the pending view was on the swapped out list, we can remove it.
   swapped_out_hosts_.erase(render_view_host_->site_instance()->id());
 
   // If the old RVH is live, we are swapping it out and should keep track of it
   // in case we navigate back to it.
   if (old_render_view_host->IsRenderViewLive()) {
     DCHECK(old_render_view_host->is_swapped_out());
-    swapped_out_hosts_[old_render_view_host->site_instance()->id()] =
-        old_render_view_host;
+    // Temp fix for http://crbug.com/90867 until we do a better cleanup to make
+    // sure we don't get different rvh instances for the same site instance
+    // in the same rvhmgr.
+    // TODO(creis): Clean this up.

[Charlie Reis, 2011/08/24 21:18:52]

Ugh, I'll try to fix the duplicated code in my next CL as well.  Can you add a
reminder to this TODO to also see SwapInRenderViewHost?

[MAD, 2011/08/24 21:31:07]

Added a note, thought you already had one here:

void RenderViewHostManager::SwapInRenderViewHost(RenderViewHost* rvh) {
  // TODO(creis): Abstract out the common code between this and CommitPending.


:-)

+    int32 old_site_instance_id = old_render_view_host->site_instance()->id();
+    RenderViewHostMap::iterator iter =
+        swapped_out_hosts_.find(old_site_instance_id);
+    if (iter != swapped_out_hosts_.end() &&
+        iter->second != old_render_view_host) {
+      iter->second->Shutdown();

[Charlie Reis, 2011/08/24 21:18:52]

Please add just a little more comment here, like "Delete the previous RVH before
we overwrite it."

[MAD, 2011/08/24 21:31:07]

Done.

+    }
+    swapped_out_hosts_[old_site_instance_id] = old_render_view_host;
   } else {
     old_render_view_host->Shutdown();
   }
 
   // Let the task manager know that we've swapped RenderViewHosts, since it
   // might need to update its process groupings.
   delegate_->NotifySwappedFromRenderManager();
 }
 
 RenderViewHost* RenderViewHostManager::UpdateRendererStateForNavigate(
@@ skipping 198 matching lines @@
       Source<NavigationController>(&delegate_->GetControllerForRenderManager()),
       Details<RenderViewHostSwitchedDetails>(&details));
 
   // If the given RVH was on the swapped out list, we can remove it.
   swapped_out_hosts_.erase(render_view_host_->site_instance()->id());
 
   // If the old RVH is live, we are swapping it out and should keep track of it
   // in case we navigate back to it.
   if (old_render_view_host->IsRenderViewLive()) {
     DCHECK(old_render_view_host->is_swapped_out());
-    swapped_out_hosts_[old_render_view_host->site_instance()->id()] =
-        old_render_view_host;
+    // Temp fix for http://crbug.com/90867 until we do a better cleanup to make
+    // sure we don't get different rvh instances for the same site instance
+    // in the same rvhmgr.
+    // TODO(creis): Clean this up.
+    int32 old_site_instance_id = old_render_view_host->site_instance()->id();
+    RenderViewHostMap::iterator iter =
+        swapped_out_hosts_.find(old_site_instance_id);
+    if (iter != swapped_out_hosts_.end() &&
+        iter->second != old_render_view_host) {
+      iter->second->Shutdown();
+    }
+    swapped_out_hosts_[old_site_instance_id] = old_render_view_host;
   } else {
     old_render_view_host->Shutdown();
   }
 
   // Let the task manager know that we've swapped RenderViewHosts, since it
   // might need to update its process groupings.
   delegate_->NotifySwappedFromRenderManager();
 }
 
 bool RenderViewHostManager::IsSwappedOut(RenderViewHost* rvh) {
   if (!rvh->site_instance())
     return false;
 
   return swapped_out_hosts_.find(rvh->site_instance()->id()) !=
       swapped_out_hosts_.end();
 }