Fix 3 crashes related to navigations after a process dies.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 9d071d5a75c280e8adb29c3ea3ee96a0d4343445..bc7aedc584bc55c85d7aa0d4bd4310fba21ef40a 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -704,14 +704,6 @@ void RenderFrameHostManager::DiscardUnusedFrame(
 
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
-  // If this is the main frame going away and there are no more references to
-  // its RenderViewHost, mark it for deletion as well so that we don't try to
-  // reuse it.
-  if (render_frame_host->frame_tree_node()->IsMainFrame() &&
-      render_frame_host->render_view_host()->ref_count() <= 1) {
-    render_frame_host->render_view_host()->set_pending_deletion();
-  }
-
   // |render_frame_host| will be deleted when its SwapOut ACK is received, or
   // when the timer times out, or when the RFHM itself is deleted (whichever
   // comes first).
@@ -727,6 +719,25 @@ bool RenderFrameHostManager::IsPendingDeletion(
   return false;
 }
 
+bool RenderFrameHostManager::IsViewPendingDeletion(
+    RenderViewHostImpl* render_view_host) {
+  // Only safe to call this on the main frame.
+  CHECK(frame_tree_node_->IsMainFrame());
+
+  // The view is not pending deletion if more than one frame or proxy references
+  // it.
+  if (render_view_host->ref_count() > 1)
+    return false;
+
+  // If the only thing referencing it is a frame on the pending deletion list,
+  // then this view will go away when the frame goes away.
+  for (const auto& rfh : pending_delete_hosts_) {
+    if (rfh->GetRenderViewHost() == render_view_host)
+      return true;
+  }
+  return false;
+}
+
 bool RenderFrameHostManager::DeleteFromPendingList(
     RenderFrameHostImpl* render_frame_host) {
   for (RFHPendingDeleteList::iterator iter = pending_delete_hosts_.begin();
@@ -2410,8 +2421,8 @@ void RenderFrameHostManager::CreateOpenerProxiesForFrameTree(
     bool need_proxy_for_speculative_rvh =
         IsBrowserSideNavigationEnabled() && speculative_render_frame_host_ &&
         speculative_render_frame_host_->GetRenderViewHost() == rvh;
-    if (rvh && rvh->IsRenderViewLive() && !need_proxy_for_pending_rvh &&
-        !need_proxy_for_speculative_rvh) {
+    if (rvh && rvh->IsRenderViewLive() && !IsViewPendingDeletion(rvh) &&
+        !need_proxy_for_pending_rvh && !need_proxy_for_speculative_rvh) {
       return;
     }