Fix for a memory corruption.

content/browser/tab_contents/render_view_host_manager.cc

Index: content/browser/tab_contents/render_view_host_manager.cc
===================================================================
--- content/browser/tab_contents/render_view_host_manager.cc	(revision 97282)
+++ content/browser/tab_contents/render_view_host_manager.cc	(working copy)
@@ -635,8 +635,18 @@
   // in case we navigate back to it.
   if (old_render_view_host->IsRenderViewLive()) {
     DCHECK(old_render_view_host->is_swapped_out());
-    swapped_out_hosts_[old_render_view_host->site_instance()->id()] =
-        old_render_view_host;
+    // Temp fix for http://crbug.com/90867 until we do a better cleanup to make
+    // sure we don't get different rvh instances for the same site instance
+    // in the same rvhmgr.
+    // TODO(creis): Clean this up.

[Charlie Reis, 2011/08/24 21:18:52]

Ugh, I'll try to fix the duplicated code in my next CL as well.  Can you add a
reminder to this TODO to also see SwapInRenderViewHost?

[MAD, 2011/08/24 21:31:07]

Added a note, thought you already had one here:

void RenderViewHostManager::SwapInRenderViewHost(RenderViewHost* rvh) {
  // TODO(creis): Abstract out the common code between this and CommitPending.


:-)

+    int32 old_site_instance_id = old_render_view_host->site_instance()->id();
+    RenderViewHostMap::iterator iter =
+        swapped_out_hosts_.find(old_site_instance_id);
+    if (iter != swapped_out_hosts_.end() &&
+        iter->second != old_render_view_host) {
+      iter->second->Shutdown();

[Charlie Reis, 2011/08/24 21:18:52]

Please add just a little more comment here, like "Delete the previous RVH before
we overwrite it."

[MAD, 2011/08/24 21:31:07]

Done.

+    }
+    swapped_out_hosts_[old_site_instance_id] = old_render_view_host;
   } else {
     old_render_view_host->Shutdown();
   }
@@ -855,8 +865,18 @@
   // in case we navigate back to it.
   if (old_render_view_host->IsRenderViewLive()) {
     DCHECK(old_render_view_host->is_swapped_out());
-    swapped_out_hosts_[old_render_view_host->site_instance()->id()] =
-        old_render_view_host;
+    // Temp fix for http://crbug.com/90867 until we do a better cleanup to make
+    // sure we don't get different rvh instances for the same site instance
+    // in the same rvhmgr.
+    // TODO(creis): Clean this up.
+    int32 old_site_instance_id = old_render_view_host->site_instance()->id();
+    RenderViewHostMap::iterator iter =
+        swapped_out_hosts_.find(old_site_instance_id);
+    if (iter != swapped_out_hosts_.end() &&
+        iter->second != old_render_view_host) {
+      iter->second->Shutdown();
+    }
+    swapped_out_hosts_[old_site_instance_id] = old_render_view_host;
   } else {
     old_render_view_host->Shutdown();
   }