Start using RenderFrameProxyHost objects.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 318 matching lines @@
 }
 
 void RenderFrameHostManager::OnCrossSiteResponse(
     RenderFrameHostImpl* pending_render_frame_host,
     const GlobalRequestID& global_request_id,
     scoped_ptr<CrossSiteTransferringRequest> cross_site_transferring_request,
     const std::vector<GURL>& transfer_url_chain,
     const Referrer& referrer,
     PageTransition page_transition,
     bool should_replace_current_entry) {
+  LOG(ERROR) << "RFHM::OnCrossSiteResponse[" << this << "]";
   // This should be called either when the pending RFH is ready to commit or
   // when we realize that the current RFH's request requires a transfer.
   DCHECK(pending_render_frame_host == pending_render_frame_host_ ||
          pending_render_frame_host == render_frame_host_);
 
   // TODO(creis): Eventually we will want to check all navigation responses
   // here, but currently we pass information for a transfer if
   // ShouldSwapProcessesForRedirect returned true in the network stack.
   // In that case, we should set up a transfer after the unload handler runs.
   // If |cross_site_transferring_request| is NULL, we will just run the unload
@@ skipping 181 matching lines @@
   // from the map and not leaked.
   RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(
       render_frame_host_->GetSiteInstance()->GetId());
   if (iter != proxy_hosts_.end()) {
     delete iter->second;
     proxy_hosts_.erase(iter);
   }
 
   RenderFrameProxyHost* proxy = new RenderFrameProxyHost(
       render_frame_host_->GetSiteInstance(), frame_tree_node_);
-  proxy_hosts_[render_frame_host_->GetSiteInstance()->GetId()] = proxy;
+  std::pair<RenderFrameProxyHostMap::iterator, bool> result =
+      proxy_hosts_.insert(std::make_pair(
+          render_frame_host_->GetSiteInstance()->GetId(), proxy));
+  CHECK(result.second) << "Inserting a duplicate item.";
 
   // Tell the old frame it is being swapped out.  This will fire the unload
   // handler in the background (without firing the beforeunload handler a second
   // time).  When the navigation completes, we will send a message to the
   // ResourceDispatcherHost, allowing the pending RVH's response to resume.
   render_frame_host_->SwapOut(proxy);
 
   // ResourceDispatcherHost has told us to run the onunload handler, which
   // means it is not a download or unsafe page, and we are going to perform the
   // navigation.  Thus, we no longer need to remember that the RenderFrameHost
@@ skipping 322 matching lines @@
 
 scoped_ptr<RenderFrameHostImpl> RenderFrameHostManager::CreateRenderFrameHost(
     SiteInstance* site_instance,
     int view_routing_id,
     int frame_routing_id,
     bool swapped_out,
     bool hidden) {
   if (frame_routing_id == MSG_ROUTING_NONE)
     frame_routing_id = site_instance->GetProcess()->GetNextRoutingID();
 
-  // Create a RVH for main frames, or find the existing one for subframes.
+  // Create a RVH for the new frame or find an existing one.
   FrameTree* frame_tree = frame_tree_node_->frame_tree();
-  RenderViewHostImpl* render_view_host = NULL;
-  if (frame_tree_node_->IsMainFrame()) {
-    render_view_host = frame_tree->CreateRenderViewHostForMainFrame(
+  RenderViewHostImpl* render_view_host =
+      frame_tree->GetRenderViewHost(site_instance);
+  LOG(ERROR) << "RFHM::CreateRenderFrameHost[" << this << "]:"
+             << " routing_id: " << frame_routing_id
+             << ", rvh: " << render_view_host
+             << ", swapped_out: " << swapped_out;
+  if (!render_view_host) {
+    render_view_host = frame_tree->CreateRenderViewHost(
         site_instance, view_routing_id, frame_routing_id, swapped_out, hidden);
-  } else {
-    render_view_host = frame_tree->GetRenderViewHostForSubFrame(site_instance);
-
-    // If we haven't found a RVH for a subframe RFH, it's because we currently
-    // do not create top-level RFHs for pending subframe navigations.  Create
-    // the RVH here for now.
-    // TODO(creis): Mirror the frame tree so this check isn't necessary.
-    if (!render_view_host) {
-      render_view_host = frame_tree->CreateRenderViewHostForMainFrame(
-          site_instance, view_routing_id, frame_routing_id, swapped_out,
-          hidden);
-    }
   }
 
   // TODO(creis): Pass hidden to RFH.
   scoped_ptr<RenderFrameHostImpl> render_frame_host =
       make_scoped_ptr(RenderFrameHostFactory::Create(render_view_host,
                                                      render_frame_delegate_,
                                                      frame_tree,
                                                      frame_tree_node_,
                                                      frame_routing_id,
                                                      swapped_out).release());
   return render_frame_host.Pass();
 }
 
 int RenderFrameHostManager::CreateRenderFrame(
     SiteInstance* instance,
     int opener_route_id,
     bool swapped_out,
     bool hidden) {
   CHECK(instance);
   DCHECK(!swapped_out || hidden); // Swapped out views should always be hidden.
 
+  LOG(ERROR) << "RFHM::CreateRenderFrame[" << this << "]:"
+    << " site:" << instance->GetSiteURL() << ", swapped:" << swapped_out;
+
+  // TODO(nasko): Remove this check once cross-site navigation no longer
+  // relies on swapped out RFH for the top-level frame.
+  if (!frame_tree_node_->IsMainFrame()) {
+    CHECK(!swapped_out);
+  }
+
   scoped_ptr<RenderFrameHostImpl> new_render_frame_host;
   RenderFrameHostImpl* frame_to_announce = NULL;
   int routing_id = MSG_ROUTING_NONE;
 
   // We are creating a pending or swapped out RFH here.  We should never create
   // it in the same SiteInstance as our current RFH.
   CHECK_NE(render_frame_host_->GetSiteInstance(), instance);
 
   // Check if we've already created an RFH for this SiteInstance.  If so, try
   // to re-use the existing one, which has already been initialized.  We'll
   // remove it from the list of swapped out hosts if it commits.
   RenderFrameProxyHost* proxy = GetRenderFrameProxyHost(instance);
 
   if (proxy) {
-    routing_id = proxy->GetRenderViewHost()->GetRoutingID();
+    routing_id = proxy->GetRoutingID();
+      LOG(ERROR) << "RFHM::CreateRenderFrame[" << this << "]:"
+          << " proxy exists: " << routing_id;
     // Delete the existing RenderFrameProxyHost, but reuse the RenderFrameHost.
     // Prevent the process from exiting while we're trying to use it.
     if (!swapped_out) {
       new_render_frame_host = proxy->PassFrameHostOwnership();
       new_render_frame_host->GetProcess()->AddPendingView();
 
       proxy_hosts_.erase(instance->GetId());
       delete proxy;
 
       // When a new render view is created by the renderer, the new WebContents
       // gets a RenderViewHost in the SiteInstance of its opener WebContents.
       // If not used in the first navigation, this RVH is swapped out and is not
       // granted bindings, so we may need to grant them when swapping it in.
       if (pending_web_ui() &&
           !new_render_frame_host->GetProcess()->IsIsolatedGuest()) {
         int required_bindings = pending_web_ui()->GetBindings();
         RenderViewHost* rvh = new_render_frame_host->render_view_host();
         if ((rvh->GetEnabledBindings() & required_bindings) !=
                 required_bindings) {
           rvh->AllowBindings(required_bindings);
         }
       }
     }
   } else {
+    LOG(ERROR) << "RFHM::CreateRenderFrame[" << this << "]:"
+        << " creating new RFH";
     // Create a new RenderFrameHost if we don't find an existing one.
     new_render_frame_host = CreateRenderFrameHost(
         instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE, swapped_out, hidden);
     RenderViewHostImpl* render_view_host =
         new_render_frame_host->render_view_host();
     int proxy_routing_id = MSG_ROUTING_NONE;
 
     // Prevent the process from exiting while we're trying to navigate in it.
     // Otherwise, if the new RFH is swapped out already, store it.
     if (!swapped_out) {
       new_render_frame_host->GetProcess()->AddPendingView();
     } else {
       proxy = new RenderFrameProxyHost(
           new_render_frame_host->GetSiteInstance(), frame_tree_node_);
       proxy_hosts_[instance->GetId()] = proxy;
       proxy->TakeFrameHostOwnership(new_render_frame_host.Pass());
       proxy_routing_id = proxy->GetRoutingID();
     }
 
     bool success = InitRenderView(
         render_view_host, opener_route_id, proxy_routing_id,
         frame_tree_node_->IsMainFrame());
-    if (success && frame_tree_node_->IsMainFrame()) {
-      // Don't show the main frame's view until we get a DidNavigate from it.
-      render_view_host->GetView()->Hide();
+    if (success) {
+      if (frame_tree_node_->IsMainFrame()) {
+        // Don't show the main frame's view until we get a DidNavigate from it.
+        render_view_host->GetView()->Hide();
+      } else if (!swapped_out) {
+        // Init the RFH, so a RenderFrame is created in the renderer.
+        DCHECK(new_render_frame_host.get());
+        success = InitRenderFrame(new_render_frame_host.get());
+      }
+      if (swapped_out) {
+        proxy_hosts_[instance->GetId()]->InitRenderFrameProxy();
+      }
     } else if (!swapped_out && pending_render_frame_host_) {
       CancelPending();
     }
     routing_id = render_view_host->GetRoutingID();
     frame_to_announce = new_render_frame_host.get();
   }
 
   // Use this as our new pending RFH if it isn't swapped out.
   if (!swapped_out)
     pending_render_frame_host_ = new_render_frame_host.Pass();
 
   // If a brand new RFH was created, announce it to observers.
   if (frame_to_announce)
     render_frame_delegate_->RenderFrameCreated(frame_to_announce);
 
+  LOG(ERROR) << "RFHM::CreateRenderFrame[" << this << "]:"
+      << "complete: " << routing_id;
+
   return routing_id;
 }
 
+int RenderFrameHostManager::CreateRenderFrameProxy(SiteInstance* instance,
+                                                   int opener_route_id) {
+  LOG(ERROR) << "RFHM::CreateRenderFrameProxy[" << this << "]:"
+      << " " << instance->GetSiteURL();
+
+  // A RenderFrameProxyHost should never be created in the same SiteInstance as
+  // the current RFH.
+  CHECK(instance);
+  CHECK_NE(instance, render_frame_host_->GetSiteInstance());
+
+  RenderFrameProxyHost* proxy = GetRenderFrameProxyHost(instance);
+  if (proxy) {
+    LOG(ERROR) << "RFHM::CreateRenderFrameProxy[" << this << "]:"
+        << " found existing proxy";
+    return proxy->GetRoutingID();
+  }
+
+  LOG(ERROR) << "RFHM::CreateRenderFrameProxy[" << this << "]:"
+      << " creating new proxy";
+  proxy = new RenderFrameProxyHost(instance, frame_tree_node_);
+  proxy_hosts_[instance->GetId()] = proxy;

[ncarter (slow), 2014/06/25 01:07:56]

Probably worthwhile to insert while checking for duplicates (should be satisfied
since we call GetRenderFrameProxyHost above)

+  proxy->InitRenderFrameProxy();
+  return proxy->GetRoutingID();
+}
+
 bool RenderFrameHostManager::InitRenderView(RenderViewHost* render_view_host,
                                             int opener_route_id,
                                             int proxy_routing_id,
                                             bool for_main_frame) {
   // We may have initialized this RenderViewHost for another RenderFrameHost.
   if (render_view_host->IsRenderViewLive())
     return true;
 
   // If the pending navigation is to a WebUI and the RenderView is not in a
   // guest process, tell the RenderViewHost about any bindings it will need
   // enabled.
   if (pending_web_ui() && !render_view_host->GetProcess()->IsIsolatedGuest()) {
     render_view_host->AllowBindings(pending_web_ui()->GetBindings());
   } else {
     // Ensure that we don't create an unprivileged RenderView in a WebUI-enabled
     // process unless it's swapped out.
     RenderViewHostImpl* rvh_impl =
         static_cast<RenderViewHostImpl*>(render_view_host);
     if (!rvh_impl->IsSwappedOut()) {
       CHECK(!ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
                 render_view_host->GetProcess()->GetID()));
     }
   }
 
   return delegate_->CreateRenderViewForRenderManager(
       render_view_host, opener_route_id, proxy_routing_id, for_main_frame);
 }
 
+bool RenderFrameHostManager::InitRenderFrame(
+    RenderFrameHost* render_frame_host) {
+  RenderFrameHostImpl* rfh =
+      static_cast<RenderFrameHostImpl*>(render_frame_host);
+  if (rfh->IsRenderFrameLive())
+    return true;
+
+  int parent_routing_id = MSG_ROUTING_NONE;
+  if (frame_tree_node_->parent()) {
+    parent_routing_id = frame_tree_node_->parent()->render_manager()->
+        GetRoutingIdForSiteInstance(render_frame_host->GetSiteInstance());
+    CHECK_NE(parent_routing_id, MSG_ROUTING_NONE);
+  }
+  return delegate_->CreateRenderFrameForRenderManager(
+      render_frame_host, parent_routing_id);
+}
+
+int RenderFrameHostManager::GetRoutingIdForSiteInstance(
+    SiteInstance* site_instance) {
+  if (render_frame_host_->GetSiteInstance() == site_instance)
+    return render_frame_host_->GetRoutingID();
+
+  RenderFrameProxyHostMap::iterator iter =
+      proxy_hosts_.find(site_instance->GetId());
+  if (iter != proxy_hosts_.end())
+    return iter->second->GetRoutingID();
+
+  return MSG_ROUTING_NONE;
+}
+
 void RenderFrameHostManager::CommitPending() {
   // First check whether we're going to want to focus the location bar after
   // this commit.  We do this now because the navigation hasn't formally
   // committed yet, so if we've already cleared |pending_web_ui_| the call chain
   // this triggers won't be able to figure out what's going on.
   bool will_focus_location_bar = delegate_->FocusLocationBarByDefault();
 
   // We expect SwapOutOldPage to have canceled any modal dialogs and told the
   // renderer to suppress any further dialogs until it is swapped out.  However,
   // crash reports indicate that it's still possible for modal dialogs to exist
@@ skipping 98 matching lines @@
 
   // If the old RFH is live, we are swapping it out and should keep track of
   // it in case we navigate back to it, or it is waiting for the unload event
   // to execute in the background.
   // TODO(creis): Swap out the subframe in --site-per-process.
   if (!CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess))
     DCHECK(old_render_frame_host->is_swapped_out() ||
            !RenderViewHostImpl::IsRVHStateActive(
                old_render_frame_host->render_view_host()->rvh_state()));
 
-  // If the RenderViewHost backing the RenderFrameHost is pending shutdown,
-  // the RenderFrameHost should be put in the map of RenderFrameHosts pending
-  // shutdown. Otherwise, it is stored in the map of proxy hosts.
-  if (old_render_frame_host->render_view_host()->rvh_state() ==
-          RenderViewHostImpl::STATE_PENDING_SHUTDOWN) {
-    // The proxy for this RenderFrameHost is created when sending the
-    // SwapOut message, so check if it already exists and delete it.
-    RenderFrameProxyHostMap::iterator iter =
-        proxy_hosts_.find(old_site_instance_id);
-    if (iter != proxy_hosts_.end()) {
-      delete iter->second;
-      proxy_hosts_.erase(iter);
-    }
-    RFHPendingDeleteMap::iterator pending_delete_iter =
-        pending_delete_hosts_.find(old_site_instance_id);
-    if (pending_delete_iter == pending_delete_hosts_.end() ||
-        pending_delete_iter->second.get() != old_render_frame_host) {
-      pending_delete_hosts_[old_site_instance_id] =
-          linked_ptr<RenderFrameHostImpl>(old_render_frame_host.release());
-    }
-  } else {
-    // Capture the active view count on the old RFH SiteInstance, since the
-    // ownership will be passed into the proxy and the pointer will be invalid.
-    int active_view_count =
-        static_cast<SiteInstanceImpl*>(old_render_frame_host->GetSiteInstance())
-            ->active_view_count();
+  // TODO(nasko): To keep it simple for now, just split the logic in top-level
+  // vs subframe.
+  if (is_main_frame) {
+    // If the RenderViewHost backing the RenderFrameHost is pending shutdown,
+    // the RenderFrameHost should be put in the map of RenderFrameHosts pending
+    // shutdown. Otherwise, it is stored in the map of proxy hosts.
+    if (old_render_frame_host->render_view_host()->rvh_state() ==
+        RenderViewHostImpl::STATE_PENDING_SHUTDOWN) {
+      // The proxy for this RenderFrameHost is created when sending the
+      // SwapOut message, so check if it already exists and delete it.
+      RenderFrameProxyHostMap::iterator iter =
+          proxy_hosts_.find(old_site_instance_id);
+      if (iter != proxy_hosts_.end()) {
+        delete iter->second;
+        proxy_hosts_.erase(iter);
+      }
+      RFHPendingDeleteMap::iterator pending_delete_iter =
+          pending_delete_hosts_.find(old_site_instance_id);
+      if (pending_delete_iter == pending_delete_hosts_.end() ||
+          pending_delete_iter->second.get() != old_render_frame_host) {
+        pending_delete_hosts_[old_site_instance_id] =
+            linked_ptr<RenderFrameHostImpl>(old_render_frame_host.release());
+      }
+    } else {
+      // Capture the active view count on the old RFH SiteInstance, since the
+      // ownership will be passed into the proxy and the pointer will be
+      // invalid.
+      int active_view_count =
+          static_cast<SiteInstanceImpl*>(
+              old_render_frame_host->GetSiteInstance())->active_view_count();
 
-    RenderFrameProxyHostMap::iterator iter =
-        proxy_hosts_.find(old_site_instance_id);
-    CHECK(iter != proxy_hosts_.end());
-    iter->second->TakeFrameHostOwnership(old_render_frame_host.Pass());
+      RenderFrameProxyHostMap::iterator iter =
+          proxy_hosts_.find(old_site_instance_id);
+      CHECK(iter != proxy_hosts_.end());
+      iter->second->TakeFrameHostOwnership(old_render_frame_host.Pass());
 
-    // If there are no active views in this SiteInstance, it means that
-    // this RFH was the last active one in the SiteInstance. Now that we
-    // know that all RFHs are swapped out, we can delete all the RFHs and RVHs
-    // in this SiteInstance.
-    if (!active_view_count) {
-      ShutdownRenderFrameHostsInSiteInstance(old_site_instance_id);
-    } else {
-      // If this is a subframe, it should have a CrossProcessFrameConnector
-      // created already and we just need to link it to the proper view in the
-      // new process.
-      if (!is_main_frame) {
-        RenderFrameProxyHost* proxy = GetProxyToParent();
-        if (proxy) {
-          proxy->SetChildRWHView(
-              render_frame_host_->render_view_host()->GetView());
+      // If there are no active views in this SiteInstance, it means that
+      // this RFH was the last active one in the SiteInstance. Now that we
+      // know that all RFHs are swapped out, we can delete all the RFHs and RVHs
+      // in this SiteInstance.
+      if (!active_view_count) {
+        ShutdownRenderFrameHostsInSiteInstance(old_site_instance_id);
+      } else {
+        // If this is a subframe, it should have a CrossProcessFrameConnector
+        // created already and we just need to link it to the proper view in the
+        // new process.
+        if (!is_main_frame) {
+          RenderFrameProxyHost* proxy = GetProxyToParent();
+          if (proxy) {
+            proxy->SetChildRWHView(
+                render_frame_host_->render_view_host()->GetView());
+          }
         }
       }
     }
+  } else {
+    CHECK(proxy_hosts_.find(render_frame_host_->GetSiteInstance()->GetId()) ==
+          proxy_hosts_.end());
+
+    // If the old frame has already completed running the unload handler,
+    // it is safe to just delete immediately. Otherwise, add it to the list
+    // of frames pending deletion.
+    if (old_render_frame_host->has_received_swap_out_ack()) {
+      old_render_frame_host.reset(NULL);
+    } else {
+      // Put the old RFH on the list of hosts pending deletion.
+      RFHPendingDeleteMap::iterator pending_delete_iter =
+          pending_delete_hosts_.find(old_site_instance_id);
+      if (pending_delete_iter == pending_delete_hosts_.end() ||
+          pending_delete_iter->second.get() != old_render_frame_host) {
+        pending_delete_hosts_[old_site_instance_id] =
+            linked_ptr<RenderFrameHostImpl>(old_render_frame_host.release());
+      }
+    }
   }
 }
 
 void RenderFrameHostManager::ShutdownRenderFrameHostsInSiteInstance(
     int32 site_instance_id) {
   // First remove any swapped out RFH for this SiteInstance from our own list.
   ClearProxiesInSiteInstance(site_instance_id, frame_tree_node_);
 
   // Use the safe RenderWidgetHost iterator for now to find all RenderViewHosts
   // in the SiteInstance, then tell their respective FrameTrees to remove all
@@ skipping 21 matching lines @@
 RenderFrameHostImpl* RenderFrameHostManager::UpdateStateForNavigate(
     const NavigationEntryImpl& entry) {
   // If we are currently navigating cross-process, we want to get back to normal
   // and then navigate as usual.
   if (cross_navigation_pending_) {
     if (pending_render_frame_host_)
       CancelPending();
     cross_navigation_pending_ = false;
   }
 
-  // render_frame_host_'s SiteInstance and new_instance will not be deleted
-  // before the end of this method, so we don't have to worry about their ref
-  // counts dropping to zero.
+  // render_frame_host_'s SiteInstance will not be deleted before the end of
+  // this method, so we don't have to worry about the ref count dropping to
+  // zero. The new_instance is possibly passed to CreateProxiesForSiteInstance,
+  // which expects properly ref-counted object, so use a scoped_refptr for it.
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
-  SiteInstance* new_instance = current_instance;
+  scoped_refptr<SiteInstance> new_instance(current_instance);
 
   // We do not currently swap processes for navigations in webview tag guests.
   bool is_guest_scheme = current_instance->GetSiteURL().SchemeIs(kGuestScheme);
 
   // Determine if we need a new BrowsingInstance for this entry.  If true, this
   // implies that it will get a new SiteInstance (and likely process), and that
   // other tabs in the current BrowsingInstance will be unable to script it.
   // This is used for cases that require a process swap even in the
   // process-per-tab model, such as WebUI pages.
   const NavigationEntry* current_entry =
@@ skipping 21 matching lines @@
     // not have its bindings set appropriately.
     SetPendingWebUI(entry);
 
     // Ensure that we have created RFHs for the new RFH's opener chain if
     // we are staying in the same BrowsingInstance. This allows the pending RFH
     // to send cross-process script calls to its opener(s).
     int opener_route_id = MSG_ROUTING_NONE;
     if (new_instance->IsRelatedSiteInstance(current_instance)) {
       opener_route_id =
           delegate_->CreateOpenerRenderViewsForRenderManager(new_instance);
+
+      if (CommandLine::ForCurrentProcess()->HasSwitch(
+              switches::kSitePerProcess)) {
+        // Create the swapped out RVH for the new SiteInstance. This will create
+        // a top-level swapped out RFH as well, which will be wrapped by a
+        // RenderFrameProxyHost in the subsequent call to create proxies.
+        if (!frame_tree_node_->IsMainFrame()) {
+          RenderViewHostImpl* render_view_host =
+              frame_tree_node_->frame_tree()->GetRenderViewHost(
+                  new_instance);
+          LOG(ERROR) << "RFHM::UpdateRendererStateForNavigate[" << this << "]:"
+              << " rvh: " << render_view_host;
+          if (!render_view_host) {
+            frame_tree_node_->frame_tree()->root()->render_manager()
+                ->CreateRenderFrame(new_instance, MSG_ROUTING_NONE, true, true);
+          }
+        }
+
+        // Ensure that the frame tree has RenderFrameProxyHosts for the new
+        // SiteInstance in all nodes except the current one.
+        frame_tree_node_->frame_tree()->CreateProxiesForSiteInstance(
+            frame_tree_node_, new_instance);
+      }
     }
 
     // Create a non-swapped-out pending RFH with the given opener and navigate
     // it.
     int route_id = CreateRenderFrame(new_instance, opener_route_id, false,
                                      delegate_->IsHidden());
     if (route_id == MSG_ROUTING_NONE)
       return NULL;
 
     // Check if our current RFH is live before we set up a transition.
     if (!render_frame_host_->render_view_host()->IsRenderViewLive()) {
+      LOG(ERROR) << "RFHM::UpdateRendererStateForNavigate[" << this << "]:"
+          << " rvh isn't live";
       if (!cross_navigation_pending_) {
+        LOG(ERROR) << "RFHM::UpdateRendererStateForNavigate[" << this << "]:"
+            << " !cross_nav_pending_, will CommitPending";
         // The current RFH is not live.  There's no reason to sit around with a
         // sad tab or a newly created RFH while we wait for the pending RFH to
         // navigate.  Just switch to the pending RFH now and go back to non
         // cross-navigating (Note that we don't care about on{before}unload
         // handlers if the current RFH isn't live.)
         CommitPending();
         return render_frame_host_.get();
       } else {
         NOTREACHED();
         return render_frame_host_.get();
       }
     }
     // Otherwise, it's safe to treat this as a pending cross-site transition.
 
     // We need to wait until the beforeunload handler has run, unless we are
     // transferring an existing request (in which case it has already run).
     // Suspend the new render view (i.e., don't let it send the cross-site
     // Navigate message) until we hear back from the old renderer's
     // beforeunload handler.  If the handler returns false, we'll have to
     // cancel the request.
     DCHECK(!pending_render_frame_host_->render_view_host()->
                are_navigations_suspended());
     bool is_transfer =
         entry.transferred_global_request_id() != GlobalRequestID();
     if (is_transfer) {
+      LOG(ERROR) << "RFHM::UpdateStateForNavigate[" << this << "]:"
+            << " is_transfer: " << pending_nav_params_->global_request_id.child_id;
       // We don't need to stop the old renderer or run beforeunload/unload
       // handlers, because those have already been done.
       DCHECK(pending_nav_params_->global_request_id ==
                 entry.transferred_global_request_id());
     } else {
+      LOG(ERROR) << "RFHM::UpdateStateForNavigate[" << this << "]:"
+            << " !is_transfer: ";
       // Also make sure the old render view stops, in case a load is in
       // progress.  (We don't want to do this for transfers, since it will
       // interrupt the transfer with an unexpected DidStopLoading.)
       render_frame_host_->render_view_host()->Send(new ViewMsg_Stop(
           render_frame_host_->render_view_host()->GetRoutingID()));
 
       pending_render_frame_host_->render_view_host()->SetNavigationsSuspended(
           true, base::TimeTicks());
 
       // Tell the CrossSiteRequestManager that this RVH has a pending cross-site
       // request, so that ResourceDispatcherHost will know to tell us to run the
       // old page's unload handler before it sends the response.
       // TODO(creis): This needs to be on the RFH.
       pending_render_frame_host_->render_view_host()->
           SetHasPendingCrossSiteRequest(true);
     }
 
     // We now have a pending RFH.
     DCHECK(!cross_navigation_pending_);
     cross_navigation_pending_ = true;
 
     // Unless we are transferring an existing request, we should now
     // tell the old render view to run its beforeunload handler, since it
     // doesn't otherwise know that the cross-site request is happening.  This
     // will trigger a call to OnBeforeUnloadACK with the reply.
     if (!is_transfer)
       render_frame_host_->DispatchBeforeUnload(true);
 
+    LOG(ERROR) << "RFHM::UpdateRendererStateForNavigate[" << this << "]:"
+               << " returning " << pending_render_frame_host_.get();
     return pending_render_frame_host_.get();
   }
 
   // Otherwise the same SiteInstance can be used.  Navigate render_frame_host_.
   DCHECK(!cross_navigation_pending_);
   if (ShouldReuseWebUI(current_entry, &entry)) {
     pending_web_ui_.reset();
     pending_and_current_web_ui_ = web_ui_->AsWeakPtr();
   } else {
     SetPendingWebUI(entry);
@@ skipping 37 matching lines @@
   // If the SiteInstance for the pending RFH is being used by others, don't
   // delete the RFH, just swap it out and it can be reused at a later point.
   SiteInstanceImpl* site_instance = static_cast<SiteInstanceImpl*>(
       pending_render_frame_host->GetSiteInstance());
   if (site_instance->active_view_count() > 1) {
     // Any currently suspended navigations are no longer needed.
     pending_render_frame_host->render_view_host()->CancelSuspendedNavigations();
 
     RenderFrameProxyHost* proxy =
         new RenderFrameProxyHost(site_instance, frame_tree_node_);
     proxy_hosts_[site_instance->GetId()] = proxy;

[ncarter (slow), 2014/06/25 01:07:56]

Is there some invariant that guarantees that a proxy host for this site instance
doesn't already exist?

     pending_render_frame_host->SwapOut(proxy);
-    proxy->TakeFrameHostOwnership(pending_render_frame_host.Pass());
+    if (frame_tree_node_->IsMainFrame()) {
+      proxy->TakeFrameHostOwnership(pending_render_frame_host.Pass());
+    }
+    proxy_hosts_[site_instance->GetId()] = proxy;

[ncarter (slow), 2014/06/25 01:07:56]

I'm fairly certain that the proxy is already in the map at this point.

Details of proof left as an exercise to the reader.

   } else {
     // We won't be coming back, so delete this one.
     pending_render_frame_host.reset();
   }
 
   pending_web_ui_.reset();
   pending_and_current_web_ui_.reset();
 }
 
 scoped_ptr<RenderFrameHostImpl> RenderFrameHostManager::SetRenderFrameHost(
@@ skipping 20 matching lines @@
 
   return old_render_frame_host.Pass();
 }
 
 bool RenderFrameHostManager::IsRVHOnSwappedOutList(
     RenderViewHostImpl* rvh) const {
   RenderFrameProxyHost* proxy = GetRenderFrameProxyHost(
       rvh->GetSiteInstance());
   if (!proxy)
     return false;
+  // If there is a proxy without RFH, it is for a subframe in the SiteInstance
+  // of |rvh|. Subframes should be ignored in this case.
+  if (!proxy->render_frame_host())
+    return false;
   return IsOnSwappedOutList(proxy->render_frame_host());
 }
 
 bool RenderFrameHostManager::IsOnSwappedOutList(
     RenderFrameHostImpl* rfh) const {
   if (!rfh->GetSiteInstance())
     return false;
 
   RenderFrameProxyHostMap::const_iterator iter = proxy_hosts_.find(
       rfh->GetSiteInstance()->GetId());
@@ skipping 15 matching lines @@
     SiteInstance* instance) const {
   RenderFrameProxyHostMap::const_iterator iter =
       proxy_hosts_.find(instance->GetId());
   if (iter != proxy_hosts_.end())
     return iter->second;
 
   return NULL;
 }
 
 }  // namespace content