Check BrowsingInstance before swapping prerenders.

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 344 matching lines @@
   for (size_t i = 0; i < g_created_callbacks.Get().size(); i++)
     g_created_callbacks.Get().at(i).Run(this);
   frame_tree_.SetFrameRemoveListener(
       base::Bind(&WebContentsImpl::OnFrameRemoved,
                  base::Unretained(this)));
 }
 
 WebContentsImpl::~WebContentsImpl() {
   is_being_destroyed_ = true;
 
+  // Update SiteInstance reference counts.
+  if (GetSiteInstance()) {

[davidben, 2014/04/29 21:31:40]

Dropped the conditional here. RVHI::GetSiteInstance() never returns NULL and it
doesn't look like RFHM::current_host() can actually be NULL? Comment says
"except in some tests". Either way, it would have crashed by then already.

+    static_cast<SiteInstanceImpl*>(GetSiteInstance())->
+        DecrementRelatedActiveContentsCount();
+  }
+
   // Delete all RFH pending shutdown, which will lead the corresponding RVH to
   // shutdown and be deleted as well.
   frame_tree_.ForEach(
       base::Bind(&RenderFrameHostManager::ClearRFHsPendingShutdown));
 
   ClearAllPowerSaveBlockers();
 
   for (std::set<RenderWidgetHostImpl*>::iterator iter =
            created_widgets_.begin(); iter != created_widgets_.end(); ++iter) {
     (*iter)->DetachDelegate();
@@ skipping 687 matching lines @@
 void WebContentsImpl::Init(const WebContents::CreateParams& params) {
   // This is set before initializing the render manager since
   // RenderFrameHostManager::Init calls back into us via its delegate to ask if
   // it should be hidden.
   should_normally_be_visible_ = !params.initially_hidden;
 
   GetRenderManager()->Init(
       params.browser_context, params.site_instance, params.routing_id,
       params.main_frame_routing_id);
 
+  // Update SiteInstance reference counts.
+  static_cast<SiteInstanceImpl*>(GetSiteInstance())->
+        IncrementRelatedActiveContentsCount();

[Charlie Reis, 2014/04/29 17:31:08]

nit: Wrong indent.

[davidben, 2014/04/29 21:31:40]

Done.

+
   view_.reset(GetContentClient()->browser()->
       OverrideCreateWebContentsView(this, &render_view_host_delegate_view_));
   if (view_) {
     CHECK(render_view_host_delegate_view_);
   } else {
     WebContentsViewDelegate* delegate =
         GetContentClient()->browser()->GetWebContentsViewDelegate(this);
 
     if (browser_plugin_guest_) {
       scoped_ptr<WebContentsViewPort> platform_view(CreateWebContentsView(
@@ skipping 1883 matching lines @@
   NotificationService::current()->Notify(
       NOTIFICATION_WEB_CONTENTS_TITLE_UPDATED,
       Source<WebContents>(this),
       Details<std::pair<NavigationEntry*, bool> >(&details));
 
   return true;
 }
 
 void WebContentsImpl::NotifySwapped(RenderViewHost* old_host,
                                     RenderViewHost* new_host) {
+  if (old_host) {
+    // Update BrowsingInstance active contents counts. If |old_host| is NULL,
+    // this is a "swap" for a crashed RVH and shouldn't be counted. This should
+    // be a no-op unless this contents swapped browsing instances due to WebUI
+    // or so.
+    static_cast<SiteInstanceImpl*>(new_host->GetSiteInstance())->
+        IncrementRelatedActiveContentsCount();
+    static_cast<SiteInstanceImpl*>(old_host->GetSiteInstance())->
+        DecrementRelatedActiveContentsCount();
+  }
+
   // After sending out a swap notification, we need to send a disconnect
   // notification so that clients that pick up a pointer to |this| can NULL the
   // pointer.  See Bug 1230284.
   notify_disconnection_ = true;
   FOR_EACH_OBSERVER(WebContentsObserver, observers_,
                     RenderViewHostChanged(old_host, new_host));
 
   // TODO(avi): Remove. http://crbug.com/170921
   std::pair<RenderViewHost*, RenderViewHost*> details =
       std::make_pair(old_host, new_host);
@@ skipping 908 matching lines @@
 
 void WebContentsImpl::OnPreferredSizeChanged(const gfx::Size& old_size) {
   if (!delegate_)
     return;
   const gfx::Size new_size = GetPreferredSize();
   if (new_size != old_size)
     delegate_->UpdatePreferredSize(this, new_size);
 }
 
 }  // namespace content