fix DOMUI pages after install of .crx

chrome/browser/renderer_host/render_view_host_manager.cc

Index: chrome/browser/renderer_host/render_view_host_manager.cc
diff --git a/chrome/browser/renderer_host/render_view_host_manager.cc b/chrome/browser/renderer_host/render_view_host_manager.cc
index 90548cf666442e86569c78c36f26f8b88af7d0dd..c0be053bf1f7055f0f57587104fdc85f8907a680 100644
--- a/chrome/browser/renderer_host/render_view_host_manager.cc
+++ b/chrome/browser/renderer_host/render_view_host_manager.cc
@@ -65,11 +65,6 @@ void RenderViewHostManager::Init(Profile* profile,
 }
 
 RenderViewHost* RenderViewHostManager::Navigate(const NavigationEntry& entry) {
-  // This will possibly create (set to NULL) a DOM UI object for the pending
-  // page. We'll use this later to give the page special access. This must
-  // happen before the new renderer is created below so it will get bindings.
-  pending_dom_ui_.reset(delegate_->CreateDOMUIForRenderManager(entry.url()));
-
   // Create a pending RenderViewHost. It will give us the one we should use
   RenderViewHost* dest_render_view_host = UpdateRendererStateForNavigate(entry);
   if (!dest_render_view_host)
@@ -493,6 +488,14 @@ RenderViewHost* RenderViewHostManager::UpdateRendererStateForNavigate(
     cross_navigation_pending_ = false;
   }
 
+  // This will possibly create (set to NULL) a DOM UI object for the pending
+  // page. We'll use this later to give the page special access. This must
+  // happen before the new renderer is created below so it will get bindings.
+  // It must also happen after the above conditional call to CancelPending(),
+  // otherwise CancelPending may clear the pending_dom_ui_ and the page will
+  // not have it's bindings set appropriately.
+  pending_dom_ui_.reset(delegate_->CreateDOMUIForRenderManager(entry.url()));
+
   // render_view_host_ will not be deleted before the end of this method, so we
   // don't have to worry about this SiteInstance's ref count dropping to zero.
   SiteInstance* curr_instance = render_view_host_->site_instance();