Ensure RenderFrameHost & NavigationHandle are not destroyed during commit

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 10615f42110f563377626bbb59613d51d09357ba..6182d2e7472e029d8ae4b2e7b2331f3b2866f243 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -208,6 +208,7 @@ RenderFrameHostImpl::RenderFrameHostImpl(SiteInstance* site_instance,
       web_ui_type_(WebUI::kNoWebUI),
       pending_web_ui_type_(WebUI::kNoWebUI),
       should_reuse_web_ui_(false),
+      is_in_commit_(false),
       weak_ptr_factory_(this) {
   bool is_swapped_out = !!(flags & CREATE_RF_SWAPPED_OUT);
   bool hidden = !!(flags & CREATE_RF_HIDDEN);
@@ -261,6 +262,8 @@ RenderFrameHostImpl::~RenderFrameHostImpl() {
   // RenderFrameHost during cleanup.
   ClearAllWebUI();
 
+  CHECK(!is_in_commit_);
+
   GetProcess()->RemoveRoute(routing_id_);
   g_routing_id_frame_map.Get().erase(
       RenderFrameHostID(GetProcess()->GetID(), routing_id_));
@@ -1085,9 +1088,20 @@ void RenderFrameHostImpl::OnDidCommitProvisionalLoad(const IPC::Message& msg) {
     }
   }
 
+  // TODO(clamy): Remove this once enough data has been gathered for
+  // crbug.com/589365.
+  is_in_commit_ = true;
+  navigation_handle_->set_is_in_commit(true);
+
   accessibility_reset_count_ = 0;
   frame_tree_node()->navigator()->DidNavigate(this, validated_params);
 
+  // TODO(clamy): Remove this once enough data has been gathered for
+  // crbug.com/589365.
+  is_in_commit_ = false;
+  if (navigation_handle_.get())

[nasko, 2016/03/15 14:10:34]

Shouldn't the handle be destroyed once we've committed?

[clamy, 2016/03/15 14:16:16]

No, hence the TODO in Navigator.

+    navigation_handle_->set_is_in_commit(false);
+
   // For a top-level frame, there are potential security concerns associated
   // with displaying graphics from a previously loaded page after the URL in
   // the omnibar has been changed. It is unappealing to clear the page