Fix use-after-free when navigating a subframe to about:blank.

content/browser/site_per_process_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/site_per_process_browsertest.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 4721 matching lines @@
 
   // Make sure the a.com renderer does not crash.
   int child_count = 0;
   EXPECT_TRUE(ExecuteScriptAndExtractInt(
       root->current_frame_host(),
       "domAutomationController.send(frames.length)",
       &child_count));
   EXPECT_EQ(1, child_count);
 }
 
+// Similar to NavigateProxyAndDetachBeforeCommit, but uses a synchronous
+// navigation to about:blank and the parent removes the child frame in a load
+// event handler for the subframe.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigateAboutBlankAndDetach) {
+  GURL main_url(
+      embedded_test_server()->GetURL("a.com", "/remove_frame_on_load.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  WebContents* contents = shell()->web_contents();
+  FrameTreeNode* root =
+      static_cast<WebContentsImpl*>(contents)->GetFrameTree()->root();
+  EXPECT_EQ(1U, root->child_count());
+  FrameTreeNode* child = root->child_at(0);
+  EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
+            child->current_frame_host()->GetSiteInstance());
+
+  // Navigate the child frame to "about:blank" from the parent document.
+  TestNavigationObserver observer(shell()->web_contents());
+  EXPECT_TRUE(
+      ExecuteScript(root->current_frame_host(),
+                    base::StringPrintf("f.src = '%s'", url::kAboutBlankURL)));

[dcheng, 2016/03/03 00:46:59]

So this navigation is sync?

[nasko, 2016/03/03 16:59:17]

Yes, otherwise it won't repro. I don't think the statement execution actually
results in a sync navigation. Rather, it hits the RemoteFrame, which sends the
navigation to the browser, which then does the cross-process swap and sends a
navigation to the newly created LocalFrame for "about:blank".

+  observer.Wait();
+
+  // Make sure the a.com renderer does not crash and the frame is removed.
+  int child_count = 0;
+  EXPECT_TRUE(ExecuteScriptAndExtractInt(
+      root->current_frame_host(), "domAutomationController.send(frames.length)",
+      &child_count));
+  EXPECT_EQ(0, child_count);
+}
+
 // Test for https://crbug.com/568670.  In A-embed-B, simultaneously have B
 // create a new (local) child frame, and have A detach B's proxy.  The child
 // frame creation sends an IPC to create a new proxy in A's process, and if
 // that IPC arrives after the detach, the new frame's parent (a proxy) won't be
 // available, and this shouldn't cause RenderFrameProxy::CreateFrameProxy to
 // crash.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        RaceBetweenCreateChildFrameAndDetachParentProxy) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
@@ skipping 592 matching lines @@
 
   // Force the renderer to generate a new frame.
   EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
                             "document.body.style.background = 'black'"));
 
   // Waits for the next frame.
   observer->Wait();
 }
 
 }  // namespace content