Diagnose RenderFrameImpl::didCommitProvisionalLoad crash.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 41daf307a3cf84ae2fd2c504e9845f93a172996f..16399063641b1a24a3e314bbd30f061c8c633669 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -13,6 +13,7 @@
 #include "base/command_line.h"
 #include "base/debug/alias.h"
 #include "base/debug/asan_invalid_access.h"
+#include "base/debug/crash_logging.h"
 #include "base/debug/dump_without_crashing.h"
 #include "base/files/file.h"
 #include "base/i18n/char_iterator.h"
@@ -1531,6 +1532,7 @@ void RenderFrameImpl::OnSwapOut(
 
   RenderViewImpl* render_view = render_view_.get();
   bool is_main_frame = is_main_frame_;
+  int routing_id = GetRoutingID();
 
   // Now that all of the cleanup is complete and the browser side is notified,
   // start using the RenderFrameProxy, if one is created.
@@ -1546,8 +1548,15 @@ void RenderFrameImpl::OnSwapOut(
 
     // For main frames, the swap should have cleared the RenderView's pointer to
     // this frame.
-    if (is_main_frame)
+    if (is_main_frame) {
+      base::debug::SetCrashKeyValue("swapout_frame_id",
+                                    base::IntToString(routing_id));
+      base::debug::SetCrashKeyValue("swapout_proxy_id",
+                                    base::IntToString(proxy->routing_id()));
+      base::debug::SetCrashKeyValue(
+          "swapout_view_id", base::IntToString(render_view->GetRoutingID()));
       CHECK(!render_view->main_render_frame_);
+    }
 
     if (is_loading)
       proxy->OnDidStartLoading();
@@ -3106,6 +3115,19 @@ void RenderFrameImpl::didCommitProvisionalLoad(
     // it needs to set RenderViewImpl's pointer for the main frame to itself
     // and ensure RenderWidget is no longer in swapped out mode.
     if (is_main_frame_) {
+      // Debug cases of https://crbug.com/575245.
+      base::debug::SetCrashKeyValue("commit_frame_id",
+                                    base::IntToString(GetRoutingID()));
+      base::debug::SetCrashKeyValue("commit_proxy_id",
+                                    base::IntToString(proxy->routing_id()));

[nasko, 2016/01/20 21:03:11]

Wouldn't |proxy| be deleted by now? The swap() call above should result in a
detach for the RemoteFrame and the associated proxy will be deleted.

[Charlie Reis, 2016/01/20 21:16:46]

You're right!  It's garbage here.  Good catch.

+      base::debug::SetCrashKeyValue(
+          "commit_view_id", base::IntToString(render_view_->GetRoutingID()));
+      if (render_view_->main_render_frame_) {
+        base::debug::SetCrashKeyValue(
+            "commit_main_render_frame_id",
+            base::IntToString(
+                render_view_->main_render_frame_->GetRoutingID()));
+      }
       CHECK(!render_view_->main_render_frame_);
       render_view_->main_render_frame_ = this;
       if (render_view_->is_swapped_out())