Prerendered pages are swapped in at browser::Navigate time.

chrome/renderer/chrome_content_renderer_client.cc

Index: chrome/renderer/chrome_content_renderer_client.cc
diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index e565ee41ca0eeff0ae731e325546de6cca707005..16f318e070aa476b5d8d182b7dd2dd9148728301 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -49,6 +49,7 @@
 #include "chrome/renderer/page_load_histograms.h"
 #include "chrome/renderer/plugins/plugin_placeholder.h"
 #include "chrome/renderer/plugins/plugin_uma.h"
+#include "chrome/renderer/prerender/prerender_dispatcher.h"
 #include "chrome/renderer/prerender/prerender_helper.h"
 #include "chrome/renderer/prerender/prerender_webmediaplayer.h"
 #include "chrome/renderer/print_web_view_helper.h"
@@ -170,6 +171,7 @@ void ChromeContentRendererClient::RenderThreadStarted() {
 #if defined(ENABLE_SAFE_BROWSING)
   phishing_classifier_.reset(safe_browsing::PhishingClassifierFilter::Create());
 #endif
+  prerender_dispatcher_.reset(new prerender::PrerenderDispatcher());
 
   RenderThread* thread = RenderThread::Get();
 
@@ -181,6 +183,7 @@ void ChromeContentRendererClient::RenderThreadStarted() {
 #endif
   thread->AddObserver(spellcheck_.get());
   thread->AddObserver(visited_link_slave_.get());
+  thread->AddObserver(prerender_dispatcher_.get());
 
   thread->RegisterExtension(extensions_v8::ExternalExtension::Get());
   thread->RegisterExtension(extensions_v8::LoadTimesExtension::Get());
@@ -643,6 +646,17 @@ bool ChromeContentRendererClient::ShouldFork(WebFrame* frame,
                                              bool is_content_initiated,
                                              bool is_initial_navigation,
                                              bool* send_referrer) {
+  // Prerendering is only allowed on top-level frames - but this should
+  // only be called on top-level, content-intiated cases.
+  DCHECK(!frame->parent());
+  DCHECK(is_content_initiated);
+
+  // Prerendered URLs go back to the browser. It's possible that the
+  // prerendered page will be destroyed by the time the browser handles the
+  // OpenURL IPC - in that case, a Navigation is done.
+  if (prerender_dispatcher_->IsPrerenderURL(url))
+    return true;
+
   const ExtensionSet* extensions = extension_dispatcher_->extensions();
 
   // Determine if the new URL is an extension (excluding bookmark apps).