Prevent RFH from attempting to transfer after it's been swapped out

content/browser/frame_host/navigation_handle_impl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_handle_impl.h"
 
 #include <utility>
 
 #include "base/logging.h"
 #include "content/browser/browsing_data/clear_site_data_throttle.h"
@@ skipping 627 matching lines @@
 
   // PlzNavigate: the final RenderFrameHost handling this navigation has been
   // decided before calling WillProcessResponse in
   // NavigationRequest::OnResponseStarted.
   // TODO(clamy): See if PlzNavigate could use this code to check whether to
   // use the RFH determined at the start of the navigation or to switch to
   // another one.
   if (IsBrowserSideNavigationEnabled())
     return true;
 
+  // A navigation form a renderer that is no longer active should not attempt to

[nasko, 2016/10/04 16:07:39]

minor nit: s/renderer/RenderFrame/

[clamy, 2016/10/04 16:12:53]

Done.

+  // transfer.
+  CHECK(render_frame_host_->is_active());
+
   // Subframes shouldn't swap processes unless out-of-process iframes are
   // possible.
   if (!IsInMainFrame() && !SiteIsolationPolicy::AreCrossProcessFramesPossible())
     return true;
 
   // If this is a download, do not do a cross-site check. The renderer will
   // see it is a download and abort the request.
   //
   // Similarly, HTTP 204 (No Content) responses leave the renderer showing the
   // previous page. The navigation should be allowed to finish without running
@@ skipping 75 matching lines @@
                       throttles_to_register.end());
     throttles_to_register.weak_clear();
   }
 }
 
 bool NavigationHandleImpl::WasStartedFromContextMenu() const {
   return started_from_context_menu_;
 }
 
 }  // namespace content