Disallow was_within_same_page = true for a cross-process navigation

content/browser/renderer_host/render_widget_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 
 #include <math.h>
 #include <set>
 #include <utility>
 
@@ skipping 1451 matching lines @@
     view_.reset();
   }
 
   process_->RemoveRoute(routing_id_);
   g_routing_id_widget_map.Get().erase(
       RenderWidgetHostID(process_->GetID(), routing_id_));
 
   if (delegate_)
     delegate_->RenderWidgetDeleted(this);
 
-  if (also_delete)
+  if (also_delete) {
+    CHECK(!owner_delegate_);

[nasko, 2016/03/01 00:27:01]

This looks like unrelated change. If it isn't, let's not put it in this CL.

[gzobqq, 2016/03/01 08:31:42]

It makes sure that a RWHI isn't deleted while owned by a scoped_ptr in RVHI.
This could happen without the additional validation of was_within_same_page in
this CL. So it's not completely unrelated, but not very related either. At first
I thought it would be a good additional check to merge, but now I see that in 48
stable, RVHI still is-a RWHI and RWHI::Destroy is used even with
owner_delegate_. So can't merge it to stable.

I'll create a separate CL for this. I think it's a good CHECK to have. It could
have prevented the UaF since chrome 49, beta. Even with this CL, the RWHI
ownership logic is complicated and there might be more paths leading to this
UaF.

     delete this;
+  }
 }
 
 void RenderWidgetHostImpl::RendererIsUnresponsive() {
   NotificationService::current()->Notify(
       NOTIFICATION_RENDER_WIDGET_HOST_HANG,
       Source<RenderWidgetHost>(this),
       NotificationService::NoDetails());
   is_unresponsive_ = true;
   if (delegate_)
     delegate_->RendererUnresponsive(this);
@@ skipping 769 matching lines @@
 }
 
 #if defined(OS_WIN)
 gfx::NativeViewAccessible
     RenderWidgetHostImpl::GetParentNativeViewAccessible() {
   return delegate_ ? delegate_->GetParentNativeViewAccessible() : NULL;
 }
 #endif
 
 }  // namespace content