Cache RenderFrameHost's parent so it doesn't change over time.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 47c7660a80a3e962a61b5f7a8d5b5311177b4c45..bc9c11831c9d5b2a4402e80263e9148b5b639b07 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -227,6 +227,7 @@ RenderFrameHostImpl::RenderFrameHostImpl(SiteInstance* site_instance,
       render_frame_proxy_host_(NULL),
       frame_tree_(frame_tree),
       frame_tree_node_(frame_tree_node),
+      parent_(nullptr),
       render_widget_host_(nullptr),
       routing_id_(routing_id),
       is_waiting_for_swapout_ack_(false),
@@ -255,8 +256,13 @@ RenderFrameHostImpl::RenderFrameHostImpl(SiteInstance* site_instance,
   site_instance_->AddObserver(this);
   GetSiteInstance()->IncrementActiveFrameCount();
 
-  // New child frames should inherit the nav_entry_id of their parent.
   if (frame_tree_node_->parent()) {
+    // Keep track of the parent RenderFrameHost, which shouldn't change even if
+    // this RenderFrameHost is on the pending deletion list and the parent
+    // FrameTreeNode has changed its current RenderFrameHost.
+    parent_ = frame_tree_node_->parent()->current_frame_host();

[alexmos, 2016/06/21 23:36:02]

Could this ever be incorrect if we try to create a new child frame in an unload
handler?  Or is that disallowed?  (I realize this will match our old behavior in
that case, just curious what should happen.)

[dcheng, 2016/06/21 23:39:47]

We don't allow frames to be attached in frames that are detaching. Might not be
a bad idea to have some enforcement in the browser though.

[Charlie Reis, 2016/06/21 23:47:23]

Yeah, I think that's something we'll want to enforce in the pending delete FTN
CL, in case there's a race.  For now, it should be safe.

+
+    // New child frames should inherit the nav_entry_id of their parent.
     set_nav_entry_id(
         frame_tree_node_->parent()->current_frame_host()->nav_entry_id());
   }
@@ -349,10 +355,7 @@ RenderProcessHost* RenderFrameHostImpl::GetProcess() {
 }
 
 RenderFrameHostImpl* RenderFrameHostImpl::GetParent() {
-  FrameTreeNode* parent_node = frame_tree_node_->parent();
-  if (!parent_node)
-    return NULL;
-  return parent_node->current_frame_host();
+  return parent_;
 }
 
 int RenderFrameHostImpl::GetFrameTreeNodeId() {
@@ -364,11 +367,9 @@ const std::string& RenderFrameHostImpl::GetFrameName() {
 }
 
 bool RenderFrameHostImpl::IsCrossProcessSubframe() {
-  FrameTreeNode* parent_node = frame_tree_node_->parent();
-  if (!parent_node)
+  if (!parent_)
     return false;
-  return GetSiteInstance() !=
-      parent_node->current_frame_host()->GetSiteInstance();
+  return GetSiteInstance() != parent_->GetSiteInstance();
 }
 
 const GURL& RenderFrameHostImpl::GetLastCommittedURL() {