Prevent RFH from attempting to transfer after it's been swapped out

content/browser/site_per_process_browsertest.cc

Index: content/browser/site_per_process_browsertest.cc
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 37978b53d46c6f7d4accb8a2f205ea2b3e26b5d2..49c85dbb52d6600fdd3ef7053e14bdd56ee8dfe7 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -8230,4 +8230,41 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigateInUnloadHandler) {
       DepictFrameTree(root));
 }
 
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
+                       RFHTransfersWhilePendingDeletion) {

[nasko, 2016/10/04 16:07:39]

I think this makes more sense to be in render_frame_host_manager_browsertests.cc
instead of here. However, let's move it along with the other followup items from
this CL.

[clamy, 2016/10/04 16:12:54]

Acknowledged.

+  GURL main_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  NavigateToURL(shell(), main_url);
+
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
+
+  // Start a cross-process navigation and wait until the response is received.
+  GURL cross_site_url_1 =
+      embedded_test_server()->GetURL("b.com", "/title1.html");
+  TestNavigationManager cross_site_manager(shell()->web_contents(),
+                                           cross_site_url_1);
+  shell()->web_contents()->GetController().LoadURL(
+      cross_site_url_1, Referrer(), ui::PAGE_TRANSITION_LINK, std::string());
+  EXPECT_TRUE(cross_site_manager.WaitForWillProcessResponse());
+
+  // Start a renderer-initiated navigation to a cross-process url and make sure
+  // the navigation will be blocked before being transferred.
+  GURL cross_site_url_2 =
+      embedded_test_server()->GetURL("c.com", "/title1.html");
+  TestNavigationManager same_site_manager(shell()->web_contents(),

[nasko, 2016/10/04 16:07:39]

nit: same_site_manager is inaccurate, since the navigation is cross-site (a.com
-> c.com).

[clamy, 2016/10/04 16:12:53]

Done.

+                                          cross_site_url_2);
+  EXPECT_TRUE(ExecuteScript(
+      root, "location.href = '" + cross_site_url_2.spec() + "';"));
+  EXPECT_TRUE(same_site_manager.WaitForWillProcessResponse());
+
+  // Now have the cross-process navigation commit and mark the current RFH as
+  // pending deletion.
+  cross_site_manager.WaitForNavigationFinished();
+
+  // Resume the navigation in the previous RFH that has just been marked as
+  // pending deletion. We should not crash.
+  same_site_manager.WaitForNavigationFinished();
+}
+
 }  // namespace content