Fix detection of RenderViewHosts pending deletion in CreateRenderViewHost.

content/browser/frame_host/frame_tree.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/frame_tree.h"
 
 #include <queue>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 256 matching lines @@
 }
 
 RenderViewHostImpl* FrameTree::CreateRenderViewHost(SiteInstance* site_instance,
                                                     int32 routing_id,
                                                     int32 main_frame_routing_id,
                                                     bool swapped_out,
                                                     bool hidden) {
   RenderViewHostMap::iterator iter =
       render_view_host_map_.find(site_instance->GetId());
   if (iter != render_view_host_map_.end()) {
-    // If a RenderViewHost's main frame is pending deletion for this
-    // |site_instance|, put it in the map of RenderViewHosts pending shutdown.
-    // Otherwise return the existing RenderViewHost for the SiteInstance.
-    RenderFrameHostImpl* main_frame = static_cast<RenderFrameHostImpl*>(
-        iter->second->GetMainFrame());
-    if (main_frame &&
-        main_frame->frame_tree_node()->render_manager()->IsPendingDeletion(
-            main_frame)) {
+    // If a RenderViewHost is pending deletion for this |site_instance|, it
+    // shouldn't be reused, so put it in the map of RenderViewHosts pending
+    // shutdown.  Otherwise, return the existing RenderViewHost for the
+    // SiteInstance.  Note that if swapped-out is forbidden, the
+    // RenderViewHost's main frame has already been cleared, so we cannot rely
+    // on checking whether the main frame is pending deletion.
+    if (iter->second->is_pending_deletion()) {
       render_view_host_pending_shutdown_map_.insert(

[alexmos, 2015/09/18 18:32:17]

Note that as we discussed, FrameTree::ReleaseRenderViewHostRef will still ensure
that the RVH's refcount drops to 0 before it is deleted.  IIUC, placing the RVH
on this map simply ensures that it won't be reused here.

[nasko, 2015/09/18 19:06:17]

Acknowledged.

           std::make_pair(site_instance->GetId(), iter->second));
       render_view_host_map_.erase(iter);
     } else {
       return iter->second;
     }
   }
   RenderViewHostImpl* rvh =
       static_cast<RenderViewHostImpl*>(RenderViewHostFactory::Create(
           site_instance, render_view_delegate_, render_widget_delegate_,
           routing_id, main_frame_routing_id, swapped_out, hidden));
@@ skipping 97 matching lines @@
   load_progress_ = 0.0;
 }
 
 bool FrameTree::IsLoading() {
   bool is_loading = false;
   ForEach(base::Bind(&IsNodeLoading, &is_loading));
   return is_loading;
 }
 
 }  // namespace content