Fix RenderView reuse issues after a pending RenderFrameHost dies.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 962 matching lines @@
 
   OpenURL(params, GetSiteInstance());
 }
 
 void RenderFrameHostImpl::OnCancelInitialHistoryLoad() {
   // A Javascript navigation interrupted the initial history load.  Check if an
   // initial subframe cross-process navigation needs to be canceled as a result.
   // TODO(creis, clamy): Cancel any cross-process navigation in PlzNavigate.
   if (GetParent() && !frame_tree_node_->has_committed_real_load() &&
       frame_tree_node_->render_manager()->pending_frame_host()) {
-    frame_tree_node_->render_manager()->CancelPending();
+    frame_tree_node_->render_manager()->CancelPendingIfNecessary(
+        frame_tree_node_->render_manager()->pending_frame_host());
   }
 }
 
 void RenderFrameHostImpl::OnDocumentOnLoadCompleted(
     FrameMsg_UILoadMetricsReportType::Value report_type,
     base::TimeTicks ui_timestamp) {
   if (report_type == FrameMsg_UILoadMetricsReportType::REPORT_LINK) {
     UMA_HISTOGRAM_CUSTOM_TIMES("Navigation.UI_OnLoadComplete.Link",
                                base::TimeTicks::Now() - ui_timestamp,
                                base::TimeDelta::FromMilliseconds(10),
@@ skipping 477 matching lines @@
   // reset.
   SetRenderFrameCreated(false);
   InvalidateMojoConnection();
 
   // Execute any pending AX tree snapshot callbacks with an empty response,
   // since we're never going to get a response from this renderer.
   for (const auto& iter : ax_tree_snapshot_callbacks_)
     iter.second.Run(ui::AXTreeUpdate());
   ax_tree_snapshot_callbacks_.clear();
 
-  // If the process has died, we don't need to wait for the swap out ack from
-  // this RenderFrame if it is pending deletion.  Complete the swap out to
-  // destroy it.
-  if (!is_active())
+  if (!is_active()) {
+    // If the process has died, we don't need to wait for the swap out ack from
+    // this RenderFrame if it is pending deletion.  Complete the swap out to
+    // destroy it.
     OnSwappedOut();
+  } else {
+    // If this was the current pending or speculative RFH dying, cancel and
+    // destroy it.
+    frame_tree_node_->render_manager()->CancelPendingIfNecessary(this);
+  }
 
   // Note: don't add any more code at this point in the function because
   // |this| may be deleted. Any additional cleanup should happen before
   // the last block of code here.
 }
 
 void RenderFrameHostImpl::OnSwappedOut() {
   // Ignore spurious swap out ack.
   if (!is_waiting_for_swapout_ack_)
     return;
@@ skipping 637 matching lines @@
   }
 #endif
 
   GetContentClient()->browser()->RegisterRenderFrameMojoInterfaces(
       GetInterfaceRegistry(), this);
 }
 
 void RenderFrameHostImpl::ResetWaitingState() {
   DCHECK(is_active());
 
-  // The active state of the RVH is determined by its main frame, since
-  // subframes should have their own widgets.
-  if (frame_tree_node_->IsMainFrame()) {
-    render_view_host_->set_is_active(true);
-    render_view_host_->set_is_swapped_out(false);
-  }
-
   // Whenever we reset the RFH state, we should not be waiting for beforeunload
   // or close acks.  We clear them here to be safe, since they can cause
   // navigations to be ignored in OnDidCommitProvisionalLoad.
   if (is_waiting_for_beforeunload_ack_) {
     is_waiting_for_beforeunload_ack_ = false;
     render_view_host_->GetWidget()->decrement_in_flight_event_count();
     render_view_host_->GetWidget()->StopHangMonitorTimeout();
   }
   send_before_unload_start_time_ = base::TimeTicks();
   render_view_host_->is_waiting_for_close_ack_ = false;
@@ skipping 876 matching lines @@
   web_bluetooth_service_->SetClientConnectionErrorHandler(base::Bind(
       &RenderFrameHostImpl::DeleteWebBluetoothService, base::Unretained(this)));
   return web_bluetooth_service_.get();
 }
 
 void RenderFrameHostImpl::DeleteWebBluetoothService() {
   web_bluetooth_service_.reset();
 }
 
 }  // namespace content