Fix 3 crashes related to navigations after a process dies.

content/browser/frame_host/frame_tree.cc

Index: content/browser/frame_host/frame_tree.cc
diff --git a/content/browser/frame_host/frame_tree.cc b/content/browser/frame_host/frame_tree.cc
index c3f130125c73748b721e94018d4acd2cce0c0426..fcc1c8f0157050b40b7f770e8df13d6d4813847b 100644
--- a/content/browser/frame_host/frame_tree.cc
+++ b/content/browser/frame_host/frame_tree.cc
@@ -355,7 +355,7 @@ RenderViewHostImpl* FrameTree::CreateRenderViewHost(
     // SiteInstance.  Note that if swapped-out is forbidden, the
     // RenderViewHost's main frame has already been cleared, so we cannot rely
     // on checking whether the main frame is pending deletion.
-    if (iter->second->is_pending_deletion()) {
+    if (root_->render_manager()->IsViewPendingDeletion(iter->second)) {

[Charlie Reis, 2016/03/28 19:06:36]

Computing this on the fly rather than keeping a bit fixes both CreateRenderView
(581912) and RenderViewInit (544755).

[alexmos, 2016/03/29 18:43:01]

Acknowledged.

       render_view_host_pending_shutdown_map_.insert(
           std::make_pair(site_instance->GetId(), iter->second));
       render_view_host_map_.erase(iter);
@@ -375,9 +375,12 @@ RenderViewHostImpl* FrameTree::CreateRenderViewHost(
 RenderViewHostImpl* FrameTree::GetRenderViewHost(SiteInstance* site_instance) {
   RenderViewHostMap::iterator iter =
       render_view_host_map_.find(site_instance->GetId());
-  if (iter == render_view_host_map_.end())
-    return nullptr;
-  return iter->second;
+  // Don't return the RVH if it is pending deletion.
+  if (iter != render_view_host_map_.end() &&
+      !root_->render_manager()->IsViewPendingDeletion(iter->second)) {

[Charlie Reis, 2016/03/28 19:06:36]

This fixes 591478.  (It would have been fixed by is_pending_deletion, too, but
we might as well use the new version.)

[alexmos, 2016/03/29 18:43:01]

Acknowledged.

+    return iter->second;
+  }
+  return nullptr;
 }
 
 void FrameTree::AddRenderViewHostRef(RenderViewHostImpl* render_view_host) {