Fix RenderView reuse issues when canceling a pending RenderFrameHost.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index dfa1744ef9d91b67f182a6c82e4aefb663004d02..db0fe69c5f807d90ba0a969a9751caba18f1fa6a 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -658,6 +658,8 @@ void RenderFrameHostManager::DiscardUnusedFrame(
   // In --site-per-process, RenderFrameHosts are not kept around and are
   // deleted when not used, replaced by RenderFrameProxyHosts.
   SiteInstanceImpl* site_instance = render_frame_host->GetSiteInstance();
+  RenderViewHostImpl* rvh = render_frame_host->render_view_host();
+  RenderFrameProxyHost* proxy = nullptr;
   if (site_instance->HasSite() && site_instance->active_frame_count() > 1) {
     // Any currently suspended navigations are no longer needed.
     render_frame_host->CancelSuspendedNavigations();
@@ -667,14 +669,24 @@ void RenderFrameHostManager::DiscardUnusedFrame(
     // |render_frame_host|, as this method is only called to discard a pending
     // or speculative RenderFrameHost, i.e. one that has never hosted an actual
     // document.
-    RenderFrameProxyHost* proxy = GetRenderFrameProxyHost(site_instance);
-    if (!proxy) {
-      proxy = CreateRenderFrameProxyHost(site_instance,
-                                         render_frame_host->render_view_host());
-    }
+    proxy = GetRenderFrameProxyHost(site_instance);
+    if (!proxy)
+      proxy = CreateRenderFrameProxyHost(site_instance, rvh);
+  }
+
+  if (frame_tree_node_->IsMainFrame()) {
+    rvh->set_main_frame_routing_id(MSG_ROUTING_NONE);
+    rvh->set_is_active(false);

[alexmos, 2016/10/12 20:29:46]

Doing this is important in the case where the replacement proxy is created
above; the RVH should be considered swapped out after this point.  When there's
no proxy created, this doesn't really matter, as this RVH will be destroyed
shortly (since render_frame_host is its last active frame).

[nasko, 2016/10/13 21:26:28]

Acknowledged.

[Charlie Reis, 2016/10/14 16:25:10]

Could you add this as a comment in the code?

[alexmos, 2016/10/14 17:07:38]

Done.  I also updated the (stale) comment on top of the if statement above to
not talk about swapping out the pending RFH.

+    rvh->set_is_swapped_out(true);
   }
 
   render_frame_host.reset();
+
+  // If a new RenderFrameProxyHost was created above, or if the old proxy isn't
+  // live, create the RenderFrameProxy in the renderer, so that other frames
+  // can still communicate with this frame.  See https://crbug.com/653746.
+  if (proxy && !proxy->is_render_frame_proxy_live())
+    proxy->InitRenderFrameProxy();

[alexmos, 2016/10/12 20:29:46]

I think it makes more sense to initialize the proxy after sending
FrameMsg_Delete as part of destroying |render_frame_host| above.  Doing it
beforehand would make Blink think that we're creating a proxy and putting it
into the tree when there's already a RenderFrame in place there, and without
going through OnSwapOut.  This seems weird, though in practice, the only thing
that broke when I tried that was a check in DevTools when I had it open
(DeviceOrientationInspectorAgent::controller assuming the page's mainFrame() is
local) when subsequently destroying the RF.

[nasko, 2016/10/13 21:26:28]

Acknowledged.

 }
 
 bool RenderFrameHostManager::DeleteFromPendingList(