Don't forward load event when a RenderFrameHost is pending deletion.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 089bd20f4e4c705bccc4fd996784c4f2707ed96c..00d60cc846e73a0b055efbf1e527ab96bfa2d3a9 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -1777,6 +1777,13 @@ void RenderFrameHostImpl::OnBeginNavigation(
 
 void RenderFrameHostImpl::OnDispatchLoad() {
   CHECK(SiteIsolationPolicy::AreCrossProcessFramesPossible());
+
+  // Don't forward the load event if this RFH is pending deletion.  This can
+  // happen in a race where this RenderFrameHost finishes loading just after
+  // the frame navigates away.  See https://crbug.com/626802.
+  if (this != frame_tree_node()->render_manager()->current_frame_host())

[Charlie Reis, 2016/08/25 21:54:01]

I think !is_active() might be a clearer way to check if this RFH is pending
deletion?

[alexmos, 2016/08/25 22:03:46]

Indeed, done.  There are a couple more instances of the old check in this file
that we can clean up in the future.

+    return;
+
   // Only frames with an out-of-process parent frame should be sending this
   // message.
   RenderFrameProxyHost* proxy =