Fix 3 crashes related to navigations after a process dies.

content/browser/frame_host/frame_tree.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/frame_tree.h"
 
 #include <stddef.h>
 
 #include <queue>
 #include <utility>
@@ skipping 337 matching lines @@
     bool hidden) {
   RenderViewHostMap::iterator iter =
       render_view_host_map_.find(site_instance->GetId());
   if (iter != render_view_host_map_.end()) {
     // If a RenderViewHost is pending deletion for this |site_instance|, it
     // shouldn't be reused, so put it in the map of RenderViewHosts pending
     // shutdown.  Otherwise, return the existing RenderViewHost for the
     // SiteInstance.  Note that if swapped-out is forbidden, the
     // RenderViewHost's main frame has already been cleared, so we cannot rely
     // on checking whether the main frame is pending deletion.
-    if (iter->second->is_pending_deletion()) {
+    if (root_->render_manager()->IsViewPendingDeletion(iter->second)) {

[Charlie Reis, 2016/03/28 19:06:36]

Computing this on the fly rather than keeping a bit fixes both CreateRenderView
(581912) and RenderViewInit (544755).

[alexmos, 2016/03/29 18:43:01]

Acknowledged.

       render_view_host_pending_shutdown_map_.insert(
           std::make_pair(site_instance->GetId(), iter->second));
       render_view_host_map_.erase(iter);
     } else {
       return iter->second;
     }
   }
   RenderViewHostImpl* rvh =
       static_cast<RenderViewHostImpl*>(RenderViewHostFactory::Create(
           site_instance, render_view_delegate_, render_widget_delegate_,
           routing_id, main_frame_routing_id, swapped_out, hidden));
 
   render_view_host_map_[site_instance->GetId()] = rvh;
   return rvh;
 }
 
 RenderViewHostImpl* FrameTree::GetRenderViewHost(SiteInstance* site_instance) {
   RenderViewHostMap::iterator iter =
       render_view_host_map_.find(site_instance->GetId());
-  if (iter == render_view_host_map_.end())
-    return nullptr;
-  return iter->second;
+  // Don't return the RVH if it is pending deletion.
+  if (iter != render_view_host_map_.end() &&
+      !root_->render_manager()->IsViewPendingDeletion(iter->second)) {

[Charlie Reis, 2016/03/28 19:06:36]

This fixes 591478.  (It would have been fixed by is_pending_deletion, too, but
we might as well use the new version.)

[alexmos, 2016/03/29 18:43:01]

Acknowledged.

+    return iter->second;
+  }
+  return nullptr;
 }
 
 void FrameTree::AddRenderViewHostRef(RenderViewHostImpl* render_view_host) {
   SiteInstance* site_instance = render_view_host->GetSiteInstance();
   RenderViewHostMap::iterator iter =
       render_view_host_map_.find(site_instance->GetId());
   CHECK(iter != render_view_host_map_.end());
   CHECK(iter->second == render_view_host);
 
   iter->second->increment_ref_count();
@@ skipping 113 matching lines @@
   // This is only used to set page-level focus in cross-process subframes, and
   // requests to set focus in main frame's SiteInstance are ignored.
   if (instance != root_manager->current_frame_host()->GetSiteInstance()) {
     RenderFrameProxyHost* proxy =
         root_manager->GetRenderFrameProxyHost(instance);
     proxy->Send(new InputMsg_SetFocus(proxy->GetRoutingID(), is_focused));
   }
 }
 
 }  // namespace content