Fixed race-condition in RenderViewHost(Manager)

content/browser/tab_contents/tab_contents.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/tab_contents/tab_contents.h"
 
 #include <cmath>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
@@ skipping 81 matching lines @@
 //   to the current RVH.
 // - Once the onunload handler is finished, a SwapOut_ACK message is sent to
 //   the ResourceDispatcherHost, who unpauses the response.  Data is then sent
 //   to the pending RVH.
 // - The pending renderer sends a FrameNavigate message that invokes the
 //   DidNavigate method.  This replaces the current RVH with the
 //   pending RVH.
 // - The previous renderer is kept swapped out in RenderViewHostManager in case
 //   the user goes back.  The process only stays live if another tab is using
 //   it, but if so, the existing frame relationships will be maintained.
+//
+// It is possible that we trigger a new navigation after we have received
+// a SwapOut_ACK message but before the FrameNavigation has been confirmed.
+// In this case the old RVH has been swapped out but the new one has not
+// replaced it, yet. Therefore, we cancel the pending RVH and skip the unloading
+// of the old RVH.
 
 namespace {
 
 // Amount of time we wait between when a key event is received and the renderer
 // is queried for its state and pushed to the NavigationEntry.
 const int kQueryStateDelay = 5000;
 
 const int kSyncWaitDelay = 40;
 
 static const char kDotGoogleDotCom[] = ".google.com";
@@ skipping 1918 matching lines @@
 
 void TabContents::CreateViewAndSetSizeForRVH(RenderViewHost* rvh) {
   RenderWidgetHostView* rwh_view = view()->CreateViewForWidget(rvh);
   rwh_view->SetSize(view()->GetContainerSize());
 }
 
 bool TabContents::GotResponseToLockMouseRequest(bool allowed) {
   return render_view_host() ?
       render_view_host()->GotResponseToLockMouseRequest(allowed) : false;
 }