Fix RenderView reuse issues after a pending RenderFrameHost dies.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 1a55641cb0cbc7d1dfeb60d0cfd413f12035677b..a980f46378f7ce02abc7e3aaf3bbf6e0b9d7936b 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -1478,11 +1478,16 @@ void RenderFrameHostImpl::OnRenderProcessGone(int status, int exit_code) {
     iter.second.Run(ui::AXTreeUpdate());
   ax_tree_snapshot_callbacks_.clear();
 
-  // If the process has died, we don't need to wait for the swap out ack from
-  // this RenderFrame if it is pending deletion.  Complete the swap out to
-  // destroy it.
-  if (!is_active())
+  if (!is_active()) {
+    // If the process has died, we don't need to wait for the swap out ack from
+    // this RenderFrame if it is pending deletion.  Complete the swap out to
+    // destroy it.
     OnSwappedOut();
+  } else {
+    // If this was the current pending or speculative RFH dying, cancel and
+    // destroy it.
+    frame_tree_node_->render_manager()->CancelPendingIfNecessary(this);
+  }
 
   // Note: don't add any more code at this point in the function because
   // |this| may be deleted. Any additional cleanup should happen before
@@ -2140,13 +2145,6 @@ void RenderFrameHostImpl::RegisterMojoInterfaces() {
 void RenderFrameHostImpl::ResetWaitingState() {
   DCHECK(is_active());
 
-  // The active state of the RVH is determined by its main frame, since
-  // subframes should have their own widgets.
-  if (frame_tree_node_->IsMainFrame()) {
-    render_view_host_->set_is_active(true);

[alexmos, 2016/08/08 23:59:01]

Looking at whether this might affect is_active() uses, one case I'm not sure
about is in RenderFrameHostImpl::UpdatePendingWebUI:

  } else if (render_view_host_->is_active()) {
    // If the ongoing navigation is not to a WebUI or the RenderView is in a
    // guest process, ensure that we don't create an unprivileged RenderView in
    // a WebUI-enabled process unless it's swapped out.
    bool url_acceptable_for_webui =
        WebUIControllerFactoryRegistry::GetInstance()->IsURLAcceptableForWebUI(
            GetSiteInstance()->GetBrowserContext(), dest_url);
    if (!url_acceptable_for_webui) {
      CHECK(!ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
          GetProcess()->GetID()));
    }
  }

This looks like it might skip this check now when the RVH starts out as
swapped-out and later is reused and becomes active, as it seems this check will
be done as part of UpdateStateForNavigate before commit, so before we make the
RVH active per my CL.  Do you know if this intends to enforce the CHECK in that
case?

[nasko, 2016/08/09 18:32:32]

I don't know and don't recall :(.

However, bindings are granted through an IPC we send to the renderer, so if the
RV was dead and recreated, then the RV wouldn't have the bindings by default
IIRC. They are explicitly granted for WebUI as part of
MojoWebUIControllerBase::RenderViewCreated.

[alexmos, 2016/08/09 23:09:46]

Ah, this is probably fine then.  Thanks!

-    render_view_host_->set_is_swapped_out(false);
-  }
-
   // Whenever we reset the RFH state, we should not be waiting for beforeunload
   // or close acks.  We clear them here to be safe, since they can cause
   // navigations to be ignored in OnDidCommitProvisionalLoad.