Fix 3 crashes related to navigations after a process dies.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 9d071d5a75c280e8adb29c3ea3ee96a0d4343445..bc7aedc584bc55c85d7aa0d4bd4310fba21ef40a 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -704,14 +704,6 @@ void RenderFrameHostManager::DiscardUnusedFrame(
 
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
-  // If this is the main frame going away and there are no more references to
-  // its RenderViewHost, mark it for deletion as well so that we don't try to
-  // reuse it.
-  if (render_frame_host->frame_tree_node()->IsMainFrame() &&
-      render_frame_host->render_view_host()->ref_count() <= 1) {
-    render_frame_host->render_view_host()->set_pending_deletion();
-  }
-
   // |render_frame_host| will be deleted when its SwapOut ACK is received, or
   // when the timer times out, or when the RFHM itself is deleted (whichever
   // comes first).
@@ -727,6 +719,25 @@ bool RenderFrameHostManager::IsPendingDeletion(
   return false;
 }
 
+bool RenderFrameHostManager::IsViewPendingDeletion(
+    RenderViewHostImpl* render_view_host) {
+  // Only safe to call this on the main frame.
+  CHECK(frame_tree_node_->IsMainFrame());
+
+  // The view is not pending deletion if more than one frame or proxy references
+  // it.
+  if (render_view_host->ref_count() > 1)
+    return false;
+
+  // If the only thing referencing it is a frame on the pending deletion list,
+  // then this view will go away when the frame goes away.
+  for (const auto& rfh : pending_delete_hosts_) {
+    if (rfh->GetRenderViewHost() == render_view_host)
+      return true;
+  }
+  return false;
+}
+
 bool RenderFrameHostManager::DeleteFromPendingList(
     RenderFrameHostImpl* render_frame_host) {
   for (RFHPendingDeleteList::iterator iter = pending_delete_hosts_.begin();
@@ -2410,8 +2421,8 @@ void RenderFrameHostManager::CreateOpenerProxiesForFrameTree(
     bool need_proxy_for_speculative_rvh =
         IsBrowserSideNavigationEnabled() && speculative_render_frame_host_ &&
         speculative_render_frame_host_->GetRenderViewHost() == rvh;
-    if (rvh && rvh->IsRenderViewLive() && !need_proxy_for_pending_rvh &&
-        !need_proxy_for_speculative_rvh) {
+    if (rvh && rvh->IsRenderViewLive() && !IsViewPendingDeletion(rvh) &&

[alexmos, 2016/03/29 18:43:01]

Why is IsViewPendingDeletion necessary here?  it seems rvh comes from
GetRenderViewHost, which already checks for this.

[Charlie Reis, 2016/03/29 20:29:02]

Ha!  Good point.  I put it in to make the test fail (without the fixes), since
it was odd that we weren't accounting for pending delete RVHs here.  But now
that we have the fix for GetRenderViewHost() as well, this is redundant with
that.

+        !need_proxy_for_pending_rvh && !need_proxy_for_speculative_rvh) {
       return;
     }