Send replies to sync IPCs from swapped out renderers.

content/browser/tab_contents/tab_contents.cc

Index: content/browser/tab_contents/tab_contents.cc
diff --git a/content/browser/tab_contents/tab_contents.cc b/content/browser/tab_contents/tab_contents.cc
index cf79d601313529b907fc776712891529b885a35d..ea01d91660df496267e5070e4f6b0fc037fd0b6a 100644
--- a/content/browser/tab_contents/tab_contents.cc
+++ b/content/browser/tab_contents/tab_contents.cc
@@ -2008,7 +2008,7 @@ void TabContents::RequestTransferURL(const GURL& url,
 }
 
 void TabContents::RunJavaScriptMessage(
-    const RenderViewHost* rvh,
+    RenderViewHost* rvh,
     const string16& message,
     const string16& default_prompt,
     const GURL& frame_url,
@@ -2052,13 +2052,13 @@ void TabContents::RunJavaScriptMessage(
   if (suppress_this_message) {
     // If we are suppressing messages, just reply as if the user immediately
     // pressed "Cancel".
-    OnDialogClosed(reply_msg, false, string16());
+    OnDialogClosed(rvh, reply_msg, false, string16());
   }
 
   *did_suppress_message = suppress_this_message;
 }
 
-void TabContents::RunBeforeUnloadConfirm(const RenderViewHost* rvh,
+void TabContents::RunBeforeUnloadConfirm(RenderViewHost* rvh,
                                          const string16& message,
                                          IPC::Message* reply_msg) {
   if (delegate_)
@@ -2069,7 +2069,8 @@ void TabContents::RunBeforeUnloadConfirm(const RenderViewHost* rvh,
       !delegate_ ||
       delegate_->ShouldSuppressDialogs();
   if (suppress_this_message) {
-    GetRenderViewHost()->JavaScriptDialogClosed(reply_msg, true, string16());
+    // The reply must be sent to the RVH that sent the request.
+    rvh->JavaScriptDialogClosed(reply_msg, true, string16());
     return;
   }
 
@@ -2255,7 +2256,8 @@ bool TabContents::CreateRenderViewForRenderManager(
   return true;
 }
 
-void TabContents::OnDialogClosed(IPC::Message* reply_msg,
+void TabContents::OnDialogClosed(RenderViewHost* rvh,
+                                 IPC::Message* reply_msg,
                                  bool success,
                                  const string16& user_input) {
   if (is_showing_before_unload_dialog_ && !success) {
@@ -2266,7 +2268,11 @@ void TabContents::OnDialogClosed(IPC::Message* reply_msg,
     tab_close_start_time_ = base::TimeTicks();
   }
   is_showing_before_unload_dialog_ = false;
-  GetRenderViewHost()->JavaScriptDialogClosed(reply_msg, success, user_input);
+  // The reply must be sent to the RVH that sent the request.
+  // TODO(creis): Eliminate cases where we pass in null.
+  if (!rvh)
+    rvh = GetRenderViewHost();
+  rvh->JavaScriptDialogClosed(reply_msg, success, user_input);
 }
 
 gfx::NativeWindow TabContents::GetDialogRootWindow() const {