Always swap with a replacement proxy in OnSwapOut.

content/browser/frame_host/render_frame_host_manager_browsertest.cc

Index: content/browser/frame_host/render_frame_host_manager_browsertest.cc
diff --git a/content/browser/frame_host/render_frame_host_manager_browsertest.cc b/content/browser/frame_host/render_frame_host_manager_browsertest.cc
index 7bc7c1c24f6e19b11b922697851a2db16273ead1..1b418eda51f0b6457f804ef3e7b9f4fef33f35f6 100644
--- a/content/browser/frame_host/render_frame_host_manager_browsertest.cc
+++ b/content/browser/frame_host/render_frame_host_manager_browsertest.cc
@@ -2401,9 +2401,10 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   ASSERT_TRUE(rfh_a->IsRenderFrameLive());
   ASSERT_FALSE(rfh_a->is_active());
 
-  // The corresponding RVH should not be pending deletion due to the proxy.
-  EXPECT_FALSE(root->render_manager()->IsViewPendingDeletion(
-                  rfh_a->render_view_host()));
+  // The corresponding RVH should still be referenced by the proxy and the old
+  // frame.
+  RenderViewHostImpl* rvh_a = rfh_a->render_view_host();
+  EXPECT_EQ(2, rvh_a->ref_count());
 
   // Kill the old process.
   RenderProcessHost* process = rfh_a->GetProcess();
@@ -2414,11 +2415,21 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   EXPECT_FALSE(popup_root->current_frame_host()->IsRenderFrameLive());
   // |rfh_a| is now deleted, thanks to the bug fix.
 
+  // With |rfh_a| gone, the RVH should only be referenced by the (dead) proxy.
+  EXPECT_EQ(1, rvh_a->ref_count());
+  EXPECT_TRUE(root->render_manager()->GetRenderFrameProxyHost(site_instance_a));
+  EXPECT_FALSE(root->render_manager()
+                   ->GetRenderFrameProxyHost(site_instance_a)
+                   ->is_render_frame_proxy_live());
+
   // Close the popup so there is no proxy for a.com in the original tab.
   new_shell->Close();
   EXPECT_FALSE(
       root->render_manager()->GetRenderFrameProxyHost(site_instance_a));
 
+  // This should delete the RVH as well.
+  EXPECT_FALSE(root->frame_tree()->GetRenderViewHost(site_instance_a));
+
   // Go back in the main frame from b.com to a.com. In https://crbug.com/581912,
   // the browser process would crash here because there was no main frame
   // routing ID or proxy in RVHI::CreateRenderView.
@@ -2454,12 +2465,14 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   commit_observer.WaitForCommit();
   EXPECT_NE(site_instance_a, shell()->web_contents()->GetSiteInstance());
 
-  // The previous RFH and RVH should still be pending deletion, as we wait for
-  // either the SwapOut ACK or a timeout.
+  // The previous RFH should still be pending deletion, as we wait for either
+  // the SwapOut ACK or a timeout.
   ASSERT_TRUE(rfh_a->IsRenderFrameLive());
   ASSERT_FALSE(rfh_a->is_active());
-  EXPECT_TRUE(root->render_manager()->IsViewPendingDeletion(
-                  rfh_a->render_view_host()));
+
+  // When the previous RFH was swapped out, it should have still gotten a
+  // replacement proxy even though it's the last active frame in the process.
+  EXPECT_TRUE(root->render_manager()->GetRenderFrameProxyHost(site_instance_a));
 
   // Open a popup in the new B process.
   Shell* new_shell =
@@ -2468,8 +2481,8 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
             new_shell->web_contents()->GetSiteInstance());
 
   // Navigate the popup to the original site, but don't wait for commit (which
-  // won't happen).  This creates a proxy in the original tab, alongside the
-  // RFH and RVH pending deletion.
+  // won't happen).  This should reuse the proxy in the original tab, which at
+  // this point exists alongside the RFH pending deletion.
   new_shell->LoadURL(embedded_test_server()->GetURL("a.com", "/title2.html"));
   EXPECT_TRUE(root->render_manager()->GetRenderFrameProxyHost(site_instance_a));