Fix RenderView reuse issues when canceling a pending RenderFrameHost.

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <stdint.h>
 #include <map>
 #include <utility>
 
@@ skipping 93 matching lines @@
   RenderWidget* render_widget = nullptr;
   blink::WebRemoteFrame* web_frame = nullptr;
 
   if (!parent) {
     // Create a top level WebRemoteFrame.
     render_view = RenderViewImpl::FromRoutingID(render_view_routing_id);
     web_frame = blink::WebRemoteFrame::create(replicated_state.scope,
                                               proxy.get(), opener);
     render_view->webview()->setMainFrame(web_frame);
     render_widget = render_view->GetWidget();
+
+    // If the RenderView is reused by this proxy after having been used for a
+    // pending RenderFrame that was discarded, its swapped out state needs to
+    // be updated, as the OnSwapOut flow which normally does this won't happen
+    // in that case.  See https://crbug.com/653746 and
+    // https://crbug.com/651980.
+    if (!render_view->is_swapped_out())
+      render_view->SetSwappedOut(true);
   } else {
     // Create a frame under an existing parent. The parent is always expected
     // to be a RenderFrameProxy, because navigations initiated by local frames
     // should not wind up here.
 
     web_frame = parent->web_frame()->createRemoteChild(
         replicated_state.scope,
         blink::WebString::fromUTF8(replicated_state.name),
         blink::WebString::fromUTF8(replicated_state.unique_name),
         replicated_state.sandbox_flags, proxy.get(), opener);
@@ skipping 371 matching lines @@
                                     blink::WebLocalFrame* source) {
   int source_routing_id = RenderFrameImpl::FromWebFrame(source)->GetRoutingID();
   Send(new FrameHostMsg_AdvanceFocus(routing_id_, type, source_routing_id));
 }
 
 void RenderFrameProxy::frameFocused() {
   Send(new FrameHostMsg_FrameFocused(routing_id_));
 }
 
 }  // namespace