Cache RenderFrameHost's parent so it doesn't change over time.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 209 matching lines @@
                                          int32_t widget_routing_id,
                                          bool hidden)
     : render_view_host_(render_view_host),
       delegate_(delegate),
       site_instance_(static_cast<SiteInstanceImpl*>(site_instance)),
       process_(site_instance->GetProcess()),
       cross_process_frame_connector_(NULL),
       render_frame_proxy_host_(NULL),
       frame_tree_(frame_tree),
       frame_tree_node_(frame_tree_node),
+      parent_(nullptr),
       render_widget_host_(nullptr),
       routing_id_(routing_id),
       is_waiting_for_swapout_ack_(false),
       render_frame_created_(false),
       navigations_suspended_(false),
       is_waiting_for_beforeunload_ack_(false),
       unload_ack_is_for_navigation_(false),
       is_loading_(false),
       pending_commit_(false),
       nav_entry_id_(0),
       accessibility_reset_token_(0),
       accessibility_reset_count_(0),
       browser_plugin_embedder_ax_tree_id_(AXTreeIDRegistry::kNoAXTreeID),
       no_create_browser_accessibility_manager_for_testing_(false),
       web_ui_type_(WebUI::kNoWebUI),
       pending_web_ui_type_(WebUI::kNoWebUI),
       should_reuse_web_ui_(false),
       last_navigation_lofi_state_(LOFI_UNSPECIFIED),
       frame_host_binding_(this),
       weak_ptr_factory_(this) {
   frame_tree_->AddRenderViewHostRef(render_view_host_);
   GetProcess()->AddRoute(routing_id_, this);
   g_routing_id_frame_map.Get().insert(std::make_pair(
       RenderFrameHostID(GetProcess()->GetID(), routing_id_),
       this));
   site_instance_->AddObserver(this);
   GetSiteInstance()->IncrementActiveFrameCount();
 
-  // New child frames should inherit the nav_entry_id of their parent.
   if (frame_tree_node_->parent()) {
+    // Keep track of the parent RenderFrameHost, which shouldn't change even if
+    // this RenderFrameHost is on the pending deletion list and the parent
+    // FrameTreeNode has changed its current RenderFrameHost.
+    parent_ = frame_tree_node_->parent()->current_frame_host();

[alexmos, 2016/06/21 23:36:02]

Could this ever be incorrect if we try to create a new child frame in an unload
handler?  Or is that disallowed?  (I realize this will match our old behavior in
that case, just curious what should happen.)

[dcheng, 2016/06/21 23:39:47]

We don't allow frames to be attached in frames that are detaching. Might not be
a bad idea to have some enforcement in the browser though.

[Charlie Reis, 2016/06/21 23:47:23]

Yeah, I think that's something we'll want to enforce in the pending delete FTN
CL, in case there's a race.  For now, it should be safe.

+
+    // New child frames should inherit the nav_entry_id of their parent.
     set_nav_entry_id(
         frame_tree_node_->parent()->current_frame_host()->nav_entry_id());
   }
 
   SetUpMojoIfNeeded();
   swapout_event_monitor_timeout_.reset(new TimeoutMonitor(base::Bind(
       &RenderFrameHostImpl::OnSwappedOut, weak_ptr_factory_.GetWeakPtr())));
 
   if (widget_routing_id != MSG_ROUTING_NONE) {
     // TODO(avi): Once RenderViewHostImpl has-a RenderWidgetHostImpl, the main
@@ skipping 72 matching lines @@
 
 SiteInstanceImpl* RenderFrameHostImpl::GetSiteInstance() {
   return site_instance_.get();
 }
 
 RenderProcessHost* RenderFrameHostImpl::GetProcess() {
   return process_;
 }
 
 RenderFrameHostImpl* RenderFrameHostImpl::GetParent() {
-  FrameTreeNode* parent_node = frame_tree_node_->parent();
-  if (!parent_node)
-    return NULL;
-  return parent_node->current_frame_host();
+  return parent_;
 }
 
 int RenderFrameHostImpl::GetFrameTreeNodeId() {
   return frame_tree_node_->frame_tree_node_id();
 }
 
 const std::string& RenderFrameHostImpl::GetFrameName() {
   return frame_tree_node_->frame_name();
 }
 
 bool RenderFrameHostImpl::IsCrossProcessSubframe() {
-  FrameTreeNode* parent_node = frame_tree_node_->parent();
-  if (!parent_node)
+  if (!parent_)
     return false;
-  return GetSiteInstance() !=
-      parent_node->current_frame_host()->GetSiteInstance();
+  return GetSiteInstance() != parent_->GetSiteInstance();
 }
 
 const GURL& RenderFrameHostImpl::GetLastCommittedURL() {
   return last_committed_url();
 }
 
 url::Origin RenderFrameHostImpl::GetLastCommittedOrigin() {
   // Origin is stored per-FTN, so it's incorrect to call for a non-current RFH.
   CHECK(this == frame_tree_node_->current_frame_host());
   return frame_tree_node_->current_origin();
@@ skipping 2566 matching lines @@
   // handler after it's destroyed so it can't run after the RFHI is destroyed.
   web_bluetooth_service_->SetClientConnectionErrorHandler(base::Bind(
       &RenderFrameHostImpl::DeleteWebBluetoothService, base::Unretained(this)));
 }
 
 void RenderFrameHostImpl::DeleteWebBluetoothService() {
   web_bluetooth_service_.reset();
 }
 
 }  // namespace content