Fix 3 crashes related to navigations after a process dies.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 686 matching lines @@
       proxy = CreateRenderFrameProxyHost(site_instance,
                                          render_frame_host->render_view_host());
     }
   }
 
   render_frame_host.reset();
 }
 
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
-  // If this is the main frame going away and there are no more references to
-  // its RenderViewHost, mark it for deletion as well so that we don't try to
-  // reuse it.
-  if (render_frame_host->frame_tree_node()->IsMainFrame() &&
-      render_frame_host->render_view_host()->ref_count() <= 1) {
-    render_frame_host->render_view_host()->set_pending_deletion();
-  }
-
   // |render_frame_host| will be deleted when its SwapOut ACK is received, or
   // when the timer times out, or when the RFHM itself is deleted (whichever
   // comes first).
   pending_delete_hosts_.push_back(std::move(render_frame_host));
 }
 
 bool RenderFrameHostManager::IsPendingDeletion(
     RenderFrameHostImpl* render_frame_host) {
   for (const auto& rfh : pending_delete_hosts_) {
     if (rfh.get() == render_frame_host)
       return true;
   }
   return false;
 }
 
+bool RenderFrameHostManager::IsViewPendingDeletion(
+    RenderViewHostImpl* render_view_host) {
+  // Only safe to call this on the main frame.
+  CHECK(frame_tree_node_->IsMainFrame());
+
+  // The view is not pending deletion if more than one frame or proxy references
+  // it.
+  if (render_view_host->ref_count() > 1)
+    return false;
+
+  // If the only thing referencing it is a frame on the pending deletion list,
+  // then this view will go away when the frame goes away.
+  for (const auto& rfh : pending_delete_hosts_) {
+    if (rfh->GetRenderViewHost() == render_view_host)
+      return true;
+  }
+  return false;
+}
+
 bool RenderFrameHostManager::DeleteFromPendingList(
     RenderFrameHostImpl* render_frame_host) {
   for (RFHPendingDeleteList::iterator iter = pending_delete_hosts_.begin();
        iter != pending_delete_hosts_.end();
        iter++) {
     if (iter->get() == render_frame_host) {
       pending_delete_hosts_.erase(iter);
       return true;
     }
   }
@@ skipping 1721 matching lines @@
   } else if (pending_render_frame_host_) {
     send_msg(pending_render_frame_host_.get(),
              pending_render_frame_host_->GetRoutingID(), msg);
   }
 
   msg->set_routing_id(render_frame_host_->GetRoutingID());
   render_frame_host_->Send(msg);
 }
 
 }  // namespace content