Always swap with a replacement proxy in OnSwapOut.

content/browser/frame_host/render_frame_host_manager_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <set>
 
 #include "base/command_line.h"
@@ skipping 2383 matching lines @@
   commit_observer.WaitForCommit();
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             new_shell->web_contents()->GetSiteInstance());
   EXPECT_TRUE(root->render_manager()->GetRenderFrameProxyHost(site_instance_a));
 
   // The previous RFH should still be pending deletion, as we wait for either
   // the SwapOut ACK or a timeout.
   ASSERT_TRUE(rfh_a->IsRenderFrameLive());
   ASSERT_FALSE(rfh_a->is_active());
 
-  // The corresponding RVH should not be pending deletion due to the proxy.
-  EXPECT_FALSE(root->render_manager()->IsViewPendingDeletion(
-                  rfh_a->render_view_host()));
+  // The corresponding RVH should still be referenced by the proxy and the old
+  // frame.
+  RenderViewHostImpl* rvh_a = rfh_a->render_view_host();
+  EXPECT_EQ(2, rvh_a->ref_count());
 
   // Kill the old process.
   RenderProcessHost* process = rfh_a->GetProcess();
   RenderProcessHostWatcher crash_observer(
       process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
   process->Shutdown(0, false);
   crash_observer.Wait();
   EXPECT_FALSE(popup_root->current_frame_host()->IsRenderFrameLive());
   // |rfh_a| is now deleted, thanks to the bug fix.
 
+  // With |rfh_a| gone, the RVH should only be referenced by the (dead) proxy.
+  EXPECT_EQ(1, rvh_a->ref_count());
+  EXPECT_TRUE(root->render_manager()->GetRenderFrameProxyHost(site_instance_a));
+  EXPECT_FALSE(root->render_manager()
+                   ->GetRenderFrameProxyHost(site_instance_a)
+                   ->is_render_frame_proxy_live());
+
   // Close the popup so there is no proxy for a.com in the original tab.
   new_shell->Close();
   EXPECT_FALSE(
       root->render_manager()->GetRenderFrameProxyHost(site_instance_a));
 
+  // This should delete the RVH as well.
+  EXPECT_FALSE(root->frame_tree()->GetRenderViewHost(site_instance_a));
+
   // Go back in the main frame from b.com to a.com. In https://crbug.com/581912,
   // the browser process would crash here because there was no main frame
   // routing ID or proxy in RVHI::CreateRenderView.
   {
     TestNavigationObserver back_nav_load_observer(shell()->web_contents());
     shell()->web_contents()->GetController().GoBack();
     back_nav_load_observer.Wait();
   }
 }
 
@@ skipping 15 matching lines @@
   // Navigate the tab to a different site, and only wait for commit, not load
   // stop.
   RenderFrameHostImpl* rfh_a = root->current_frame_host();
   rfh_a->DisableSwapOutTimerForTesting();
   SiteInstanceImpl* site_instance_a = rfh_a->GetSiteInstance();
   TestFrameNavigationObserver commit_observer(root);
   shell()->LoadURL(embedded_test_server()->GetURL("b.com", "/title2.html"));
   commit_observer.WaitForCommit();
   EXPECT_NE(site_instance_a, shell()->web_contents()->GetSiteInstance());
 
-  // The previous RFH and RVH should still be pending deletion, as we wait for
-  // either the SwapOut ACK or a timeout.
+  // The previous RFH should still be pending deletion, as we wait for either
+  // the SwapOut ACK or a timeout.
   ASSERT_TRUE(rfh_a->IsRenderFrameLive());
   ASSERT_FALSE(rfh_a->is_active());
-  EXPECT_TRUE(root->render_manager()->IsViewPendingDeletion(
-                  rfh_a->render_view_host()));
+
+  // When the previous RFH was swapped out, it should have still gotten a
+  // replacement proxy even though it's the last active frame in the process.
+  EXPECT_TRUE(root->render_manager()->GetRenderFrameProxyHost(site_instance_a));
 
   // Open a popup in the new B process.
   Shell* new_shell =
       OpenPopup(shell()->web_contents(), GURL(url::kAboutBlankURL), "foo");
   EXPECT_EQ(shell()->web_contents()->GetSiteInstance(),
             new_shell->web_contents()->GetSiteInstance());
 
   // Navigate the popup to the original site, but don't wait for commit (which
-  // won't happen).  This creates a proxy in the original tab, alongside the
-  // RFH and RVH pending deletion.
+  // won't happen).  This should reuse the proxy in the original tab, which at
+  // this point exists alongside the RFH pending deletion.
   new_shell->LoadURL(embedded_test_server()->GetURL("a.com", "/title2.html"));
   EXPECT_TRUE(root->render_manager()->GetRenderFrameProxyHost(site_instance_a));
 
   // Kill the old process.
   RenderProcessHost* process = rfh_a->GetProcess();
   RenderProcessHostWatcher crash_observer(
       process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
   process->Shutdown(0, false);
   crash_observer.Wait();
   // |rfh_a| is now deleted, thanks to the bug fix.
@@ skipping 199 matching lines @@
     // Accessing a property with normal security checks should throw a
     // SecurityError if the same-origin windows are in different processes.
     EXPECT_THAT(result,
                 ::testing::MatchesRegex("SecurityError: Blocked a frame with "
                                         "origin \"http://a.com:\\d+\" from "
                                         "accessing a cross-origin frame."));
   }
 }
 
 }  // namespace content