Fix 3 crashes related to navigations after a process dies.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 686 matching lines @@
       proxy = CreateRenderFrameProxyHost(site_instance,
                                          render_frame_host->render_view_host());
     }
   }
 
   render_frame_host.reset();
 }
 
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
-  // If this is the main frame going away and there are no more references to
-  // its RenderViewHost, mark it for deletion as well so that we don't try to
-  // reuse it.
-  if (render_frame_host->frame_tree_node()->IsMainFrame() &&
-      render_frame_host->render_view_host()->ref_count() <= 1) {
-    render_frame_host->render_view_host()->set_pending_deletion();
-  }
-
   // |render_frame_host| will be deleted when its SwapOut ACK is received, or
   // when the timer times out, or when the RFHM itself is deleted (whichever
   // comes first).
   pending_delete_hosts_.push_back(std::move(render_frame_host));
 }
 
 bool RenderFrameHostManager::IsPendingDeletion(
     RenderFrameHostImpl* render_frame_host) {
   for (const auto& rfh : pending_delete_hosts_) {
     if (rfh.get() == render_frame_host)
       return true;
   }
   return false;
 }
 
+bool RenderFrameHostManager::IsViewPendingDeletion(
+    RenderViewHostImpl* render_view_host) {
+  // Only safe to call this on the main frame.
+  CHECK(frame_tree_node_->IsMainFrame());
+
+  // The view is not pending deletion if more than one frame or proxy references
+  // it.
+  if (render_view_host->ref_count() > 1)
+    return false;
+
+  // If the only thing referencing it is a frame on the pending deletion list,
+  // then this view will go away when the frame goes away.
+  for (const auto& rfh : pending_delete_hosts_) {
+    if (rfh->GetRenderViewHost() == render_view_host)
+      return true;
+  }
+  return false;
+}
+
 bool RenderFrameHostManager::DeleteFromPendingList(
     RenderFrameHostImpl* render_frame_host) {
   for (RFHPendingDeleteList::iterator iter = pending_delete_hosts_.begin();
        iter != pending_delete_hosts_.end();
        iter++) {
     if (iter->get() == render_frame_host) {
       pending_delete_hosts_.erase(iter);
       return true;
     }
   }
@@ skipping 1663 matching lines @@
     // we should still create a proxy, which will allow communicating with the
     // opener until the pending RenderView commits, or if the pending navigation
     // is canceled.
     // PlzNavigate: similarly, if a speculative RenderViewHost  is present, a
     // proxy should be created.
     RenderViewHostImpl* rvh = frame_tree->GetRenderViewHost(instance);
     bool need_proxy_for_pending_rvh = (rvh == pending_render_view_host());
     bool need_proxy_for_speculative_rvh =
         IsBrowserSideNavigationEnabled() && speculative_render_frame_host_ &&
         speculative_render_frame_host_->GetRenderViewHost() == rvh;
-    if (rvh && rvh->IsRenderViewLive() && !need_proxy_for_pending_rvh &&
-        !need_proxy_for_speculative_rvh) {
+    if (rvh && rvh->IsRenderViewLive() && !IsViewPendingDeletion(rvh) &&

[alexmos, 2016/03/29 18:43:01]

Why is IsViewPendingDeletion necessary here?  it seems rvh comes from
GetRenderViewHost, which already checks for this.

[Charlie Reis, 2016/03/29 20:29:02]

Ha!  Good point.  I put it in to make the test fail (without the fixes), since
it was odd that we weren't accounting for pending delete RVHs here.  But now
that we have the fix for GetRenderViewHost() as well, this is redundant with
that.

+        !need_proxy_for_pending_rvh && !need_proxy_for_speculative_rvh) {
       return;
     }
 
     if (rvh && !rvh->IsRenderViewLive()) {
       EnsureRenderViewInitialized(rvh, instance);
     } else {
       // Create a RenderFrameProxyHost in the given SiteInstance if none
       // exists. Since an opener can point to a subframe, do this on the root
       // frame of the current opener's frame tree.
       frame_tree->root()->render_manager()->CreateRenderFrameProxy(instance);
@@ skipping 36 matching lines @@
   } else if (pending_render_frame_host_) {
     send_msg(pending_render_frame_host_.get(),
              pending_render_frame_host_->GetRoutingID(), msg);
   }
 
   msg->set_routing_id(render_frame_host_->GetRoutingID());
   render_frame_host_->Send(msg);
 }
 
 }  // namespace content