Check BrowsingInstance before swapping prerenders.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 8aea87eae6df3c70b7b21a7f1ec03a1e53a1b19d..26cf46323125033dc81f2055146575796f7ab019 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -363,6 +363,10 @@ WebContentsImpl::WebContentsImpl(
 WebContentsImpl::~WebContentsImpl() {
   is_being_destroyed_ = true;
 
+  // Update SiteInstance reference counts.
+  static_cast<SiteInstanceImpl*>(GetSiteInstance())->
+      DecrementRelatedActiveContentsCount();
+
   // Delete all RFH pending shutdown, which will lead the corresponding RVH to
   // shutdown and be deleted as well.
   frame_tree_.ForEach(
@@ -1070,6 +1074,10 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
       params.browser_context, params.site_instance, params.routing_id,
       params.main_frame_routing_id);
 
+  // Update SiteInstance reference counts.

[Charlie Reis, 2014/04/29 22:13:51]

It feels strange to do this in WebContents rather than RFHM, so it would be nice
to elaborate in the comment on why this is the correct place.  Something like:

Update the count of WebContents objects using this SiteInstance.  All subframes
are in the same BrowsingInstance as the main frame, so we only do this for the
top-level frame.

[davidben, 2014/04/29 23:02:26]

Moved it to RFHM. It's much much cleaner this way.
Done.

+  static_cast<SiteInstanceImpl*>(GetSiteInstance())->
+      IncrementRelatedActiveContentsCount();
+
   view_.reset(GetContentClient()->browser()->
       OverrideCreateWebContentsView(this, &render_view_host_delegate_view_));
   if (view_) {
@@ -2981,6 +2989,17 @@ bool WebContentsImpl::UpdateTitleForEntry(NavigationEntryImpl* entry,
 
 void WebContentsImpl::NotifySwapped(RenderViewHost* old_host,
                                     RenderViewHost* new_host) {
+  if (old_host) {
+    // Update BrowsingInstance active contents counts. If |old_host| is NULL,
+    // this is a "swap" for a crashed RVH and shouldn't be counted. This should
+    // be a no-op unless this contents swapped browsing instances due to WebUI
+    // or so.
+    static_cast<SiteInstanceImpl*>(new_host->GetSiteInstance())->
+        IncrementRelatedActiveContentsCount();
+    static_cast<SiteInstanceImpl*>(old_host->GetSiteInstance())->
+        DecrementRelatedActiveContentsCount();
+  }
+
   // After sending out a swap notification, we need to send a disconnect
   // notification so that clients that pick up a pointer to |this| can NULL the
   // pointer.  See Bug 1230284.