Fix RenderView reuse issues when canceling a pending RenderFrameHost.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 640 matching lines @@
 void RenderFrameHostManager::DiscardUnusedFrame(
     std::unique_ptr<RenderFrameHostImpl> render_frame_host) {
   // TODO(carlosk): this code is very similar to what can be found in
   // SwapOutOldFrame and we should see that these are unified at some point.
 
   // If the SiteInstance for the pending RFH is being used by others don't
   // delete the RFH. Just swap it out and it can be reused at a later point.
   // In --site-per-process, RenderFrameHosts are not kept around and are
   // deleted when not used, replaced by RenderFrameProxyHosts.
   SiteInstanceImpl* site_instance = render_frame_host->GetSiteInstance();
+  RenderViewHostImpl* rvh = render_frame_host->render_view_host();
+  RenderFrameProxyHost* proxy = nullptr;
   if (site_instance->HasSite() && site_instance->active_frame_count() > 1) {
     // Any currently suspended navigations are no longer needed.
     render_frame_host->CancelSuspendedNavigations();
 
     // If a proxy already exists for the |site_instance|, just reuse it instead
     // of creating a new one. There is no need to call SwapOut on the
     // |render_frame_host|, as this method is only called to discard a pending
     // or speculative RenderFrameHost, i.e. one that has never hosted an actual
     // document.
-    RenderFrameProxyHost* proxy = GetRenderFrameProxyHost(site_instance);
-    if (!proxy) {
-      proxy = CreateRenderFrameProxyHost(site_instance,
-                                         render_frame_host->render_view_host());
-    }
+    proxy = GetRenderFrameProxyHost(site_instance);
+    if (!proxy)
+      proxy = CreateRenderFrameProxyHost(site_instance, rvh);
+  }
+
+  if (frame_tree_node_->IsMainFrame()) {
+    rvh->set_main_frame_routing_id(MSG_ROUTING_NONE);
+    rvh->set_is_active(false);

[alexmos, 2016/10/12 20:29:46]

Doing this is important in the case where the replacement proxy is created
above; the RVH should be considered swapped out after this point.  When there's
no proxy created, this doesn't really matter, as this RVH will be destroyed
shortly (since render_frame_host is its last active frame).

[nasko, 2016/10/13 21:26:28]

Acknowledged.

[Charlie Reis, 2016/10/14 16:25:10]

Could you add this as a comment in the code?

[alexmos, 2016/10/14 17:07:38]

Done.  I also updated the (stale) comment on top of the if statement above to
not talk about swapping out the pending RFH.

+    rvh->set_is_swapped_out(true);
   }
 
   render_frame_host.reset();
+
+  // If a new RenderFrameProxyHost was created above, or if the old proxy isn't
+  // live, create the RenderFrameProxy in the renderer, so that other frames
+  // can still communicate with this frame.  See https://crbug.com/653746.
+  if (proxy && !proxy->is_render_frame_proxy_live())
+    proxy->InitRenderFrameProxy();

[alexmos, 2016/10/12 20:29:46]

I think it makes more sense to initialize the proxy after sending
FrameMsg_Delete as part of destroying |render_frame_host| above.  Doing it
beforehand would make Blink think that we're creating a proxy and putting it
into the tree when there's already a RenderFrame in place there, and without
going through OnSwapOut.  This seems weird, though in practice, the only thing
that broke when I tried that was a check in DevTools when I had it open
(DeviceOrientationInspectorAgent::controller assuming the page's mainFrame() is
local) when subsequently destroying the RF.

[nasko, 2016/10/13 21:26:28]

Acknowledged.

 }
 
 bool RenderFrameHostManager::DeleteFromPendingList(
     RenderFrameHostImpl* render_frame_host) {
   for (RFHPendingDeleteList::iterator iter = pending_delete_hosts_.begin();
        iter != pending_delete_hosts_.end();
        iter++) {
     if (iter->get() == render_frame_host) {
       pending_delete_hosts_.erase(iter);
       return true;
@@ skipping 2003 matching lines @@
                                              resolved_url)) {
     DCHECK(!dest_instance ||
            dest_instance == render_frame_host_->GetSiteInstance());
     return false;
   }
 
   return true;
 }
 
 }  // namespace content