Browser Plugin: Navigating to the same URL after crash should load a new guest

chrome/renderer/resources/extensions/web_view.js

Index: chrome/renderer/resources/extensions/web_view.js
diff --git a/chrome/renderer/resources/extensions/web_view.js b/chrome/renderer/resources/extensions/web_view.js
index 73f4f1af30fd11ea1ec80dd466bb55b15eb1b0c0..f7b52f07f969de6665a1ee9d1eda8045ca9acb71 100644
--- a/chrome/renderer/resources/extensions/web_view.js
+++ b/chrome/renderer/resources/extensions/web_view.js
@@ -156,8 +156,17 @@ WebView.prototype.handleObjectMutation_ = function(mutation) {
     this.node_.removeAttribute(mutation.attributeName);
   } else {
     // Update the <webview> attribute to match the BrowserPlugin attribute.
-    this.node_.setAttribute(mutation.attributeName,
-        this.objectNode_.getAttribute(mutation.attributeName));
+    // Note: Calling setAttribute on <webview> will trigger its mutation
+    // observer which will then propagate that attribute to BrowserPlugin. In
+    // cases where we permit assigning a BrowserPlugin attribute the same value
+    // again (such as navigation when crashed), this could end up in an infinite
+    // loop. Thus, we avoid this loop by only updating the <webview> attribute
+    // if the BrowserPlugin attributes differs from it.
+    var oldValue = this.node_.getAttribute(mutation.attributeName);
+    var newValue = this.objectNode_.getAttribute(mutation.attributeName);
+    if (newValue != oldValue) {
+      this.node_.setAttribute(mutation.attributeName, newValue);
+    }
   }
 };