Check BrowsingInstance before swapping prerenders.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index bddc8de7b9cea9a3582fc124fc4cb921a73d0f2d..6e8e00101061e4c50834239ef049023c837745a3 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -362,6 +362,12 @@ WebContentsImpl::WebContentsImpl(
 WebContentsImpl::~WebContentsImpl() {
   is_being_destroyed_ = true;
 
+  // Update SiteInstance reference counts.
+  if (GetSiteInstance()) {

[davidben, 2014/04/29 21:31:40]

Dropped the conditional here. RVHI::GetSiteInstance() never returns NULL and it
doesn't look like RFHM::current_host() can actually be NULL? Comment says
"except in some tests". Either way, it would have crashed by then already.

+    static_cast<SiteInstanceImpl*>(GetSiteInstance())->
+        DecrementRelatedActiveContentsCount();
+  }
+
   // Delete all RFH pending shutdown, which will lead the corresponding RVH to
   // shutdown and be deleted as well.
   frame_tree_.ForEach(
@@ -1069,6 +1075,10 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
       params.browser_context, params.site_instance, params.routing_id,
       params.main_frame_routing_id);
 
+  // Update SiteInstance reference counts.
+  static_cast<SiteInstanceImpl*>(GetSiteInstance())->
+        IncrementRelatedActiveContentsCount();

[Charlie Reis, 2014/04/29 17:31:08]

nit: Wrong indent.

[davidben, 2014/04/29 21:31:40]

Done.

+
   view_.reset(GetContentClient()->browser()->
       OverrideCreateWebContentsView(this, &render_view_host_delegate_view_));
   if (view_) {
@@ -2972,6 +2982,17 @@ bool WebContentsImpl::UpdateTitleForEntry(NavigationEntryImpl* entry,
 
 void WebContentsImpl::NotifySwapped(RenderViewHost* old_host,
                                     RenderViewHost* new_host) {
+  if (old_host) {
+    // Update BrowsingInstance active contents counts. If |old_host| is NULL,
+    // this is a "swap" for a crashed RVH and shouldn't be counted. This should
+    // be a no-op unless this contents swapped browsing instances due to WebUI
+    // or so.
+    static_cast<SiteInstanceImpl*>(new_host->GetSiteInstance())->
+        IncrementRelatedActiveContentsCount();
+    static_cast<SiteInstanceImpl*>(old_host->GetSiteInstance())->
+        DecrementRelatedActiveContentsCount();
+  }
+
   // After sending out a swap notification, we need to send a disconnect
   // notification so that clients that pick up a pointer to |this| can NULL the
   // pointer.  See Bug 1230284.