Fix 3 crashes related to navigations after a process dies.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 82a15ffec9791aabf9b24555395067c3b3920db1..fa0d5a530c7f5bc4fb2cccd686d666086d914bd3 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -1328,6 +1328,12 @@ void RenderFrameHostImpl::OnRenderProcessGone(int status, int exit_code) {
     iter.second.Run(ui::AXTreeUpdate());
   ax_tree_snapshot_callbacks_.clear();
 
+  // If the process has died, we don't need to wait for the swap out ack from
+  // this RenderFrame if it is pending deletion.  Complete the swap out to
+  // destroy it.
+  if (frame_tree_node_->render_manager()->IsPendingDeletion(this))
+    OnSwappedOut();

[Charlie Reis, 2016/03/28 19:06:37]

This is a separate fix for CreateRenderView (581912).  Either fix is sufficient
for that bug, but it makes sense to do both.  This doesn't help with the other
bugs.

[alexmos, 2016/03/29 18:43:01]

Acknowledged.

+
   // Note: don't add any more code at this point in the function because
   // |this| may be deleted. Any additional cleanup should happen before
   // the last block of code here.
@@ -1357,6 +1363,10 @@ void RenderFrameHostImpl::OnSwappedOut() {
   CHECK(deleted);
 }
 
+void RenderFrameHostImpl::ResetSwapOutTimerForTesting() {
+  swapout_event_monitor_timeout_->Stop();
+}
+
 void RenderFrameHostImpl::OnContextMenu(const ContextMenuParams& params) {
   // Validate the URLs in |params|.  If the renderer can't request the URLs
   // directly, don't show them in the context menu.