Re-fix http://crbug.com/87176, and add a test.

content/browser/site_instance_impl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_SITE_INSTANCE_IMPL_H_
 #define CONTENT_BROWSER_SITE_INSTANCE_IMPL_H_
 
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/notification_observer.h"
@@ skipping 26 matching lines @@
   // Returns whether there is currently a related SiteInstance (registered with
   // BrowsingInstance) for the site of the given url.  If so, we should try to
   // avoid dedicating an unused SiteInstance to it (e.g., in a new tab).
   bool HasRelatedSiteInstance(const GURL& url);
 
   // Returns whether this SiteInstance has a process that is the wrong type for
   // the given URL.  If so, the browser should force a process swap when
   // navigating to the URL.
   bool HasWrongProcessForURL(const GURL& url);
 
-  // Sets the factory used to create new RenderProcessHosts. This will also be
-  // passed on to SiteInstances spawned by this one.
-  // The factory must outlive the SiteInstance; ownership is not transferred. It
-  // may be NULL, in which case the default BrowserRenderProcessHost will be
-  // created (this is the behavior if you don't call this function).
-  void set_render_process_host_factory(RenderProcessHostFactory* rph_factory) {
-    render_process_host_factory_ = rph_factory;
-  }
+  // Sets the global factory used to create new RenderProcessHosts.  It may be
+  // NULL, in which case the default BrowserRenderProcessHost will be created
+  // (this is the behavior if you don't call this function).  The factory must
+  // be set back to NULL before it's destroyed; ownership is not transferred.
+  static void set_render_process_host_factory(
+      const RenderProcessHostFactory* rph_factory);
 
  protected:
   friend class BrowsingInstance;
   friend class SiteInstance;
 
   // Virtual to allow tests to extend it.
   virtual ~SiteInstanceImpl();
 
   // Create a new SiteInstance.  Protected to give access to BrowsingInstance
   // and tests; most callers should use Create or GetRelatedSiteInstance
   // instead.
   explicit SiteInstanceImpl(BrowsingInstance* browsing_instance);
 
  private:
   // Get the effective URL for the given actual URL.
   static GURL GetEffectiveURL(BrowserContext* browser_context,
                               const GURL& url);
 
   // NotificationObserver implementation.
   virtual void Observe(int type,
                        const NotificationSource& source,
                        const NotificationDetails& details) OVERRIDE;
 
   // Used to restrict a process' origin access rights.
   void LockToOrigin();
 
+  // An object used to construct RenderProcessHosts.
+  static const RenderProcessHostFactory* g_render_process_host_factory_;
+
   // The next available SiteInstance ID.
   static int32 next_site_instance_id_;
 
   // A unique ID for this SiteInstance.
   int32 id_;
 
   NotificationRegistrar registrar_;
 
   // BrowsingInstance to which this SiteInstance belongs.
   scoped_refptr<BrowsingInstance> browsing_instance_;
@@ skipping 13 matching lines @@
 
   // Whether SetSite has been called.
   bool has_site_;
 
   DISALLOW_COPY_AND_ASSIGN(SiteInstanceImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_SITE_INSTANCE_IMPL_H_