Check BrowsingInstance before swapping prerenders.

content/browser/browsing_instance.h

Index: content/browser/browsing_instance.h
diff --git a/content/browser/browsing_instance.h b/content/browser/browsing_instance.h
index 60aa47b19dce5608f3c547d956157a3f42570f16..ec401f6bb3153d4fd3905f7081cd1da0fc4957d5 100644
--- a/content/browser/browsing_instance.h
+++ b/content/browser/browsing_instance.h
@@ -79,6 +79,11 @@ class CONTENT_EXPORT BrowsingInstance
   // BrowsingInstance.
   void UnregisterSiteInstance(SiteInstance* site_instance);
 
+  // Tracks the number of WebContents currently in this BrowsingInstance.
+  size_t active_contents_count() const { return active_contents_count_; }
+  void increment_active_contents_count() { active_contents_count_++; }
+  void decrement_active_contents_count() { active_contents_count_--; }
+
   friend class SiteInstanceImpl;
   friend class SiteInstance;
 
@@ -89,6 +94,7 @@ class CONTENT_EXPORT BrowsingInstance
 
  private:
   // Map of site to SiteInstance, to ensure we only have one SiteInstance per
+  // site.
   typedef base::hash_map<std::string, SiteInstance*> SiteInstanceMap;
 
   // Common browser context to which all SiteInstances in this BrowsingInstance
@@ -100,8 +106,13 @@ class CONTENT_EXPORT BrowsingInstance
   // obtained with SiteInstanceImpl::GetSiteForURL.  Note that this map may not
   // contain every active SiteInstance, because a race exists where two
   // SiteInstances can be assigned to the same site.  This is ok in rare cases.
+  // It also does not contain SiteInstances which have not yet been assigned a
+  // site, such as about:blank.  See NavigatorImpl::ShouldAssignSiteForURL.
   SiteInstanceMap site_instance_map_;
 
+  // Number of WebContentses currently using this BrowsingInstance.
+  size_t active_contents_count_;
+
   DISALLOW_COPY_AND_ASSIGN(BrowsingInstance);
 };