Fix remote-to-local navigations in crashed subframes.

content/renderer/render_frame_impl.h

Index: content/renderer/render_frame_impl.h
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 2132cb23060fef2c33c36566932275c1b7763222..7e811c6a82e3055fc927b70f1f49ec513a1b29ef 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -789,6 +789,14 @@ class CONTENT_EXPORT RenderFrameImpl
                                     blink::WebHistoryCommitType commit_type,
                                     const blink::WebHistoryItem& item);
 
+  // Swaps the current frame into the frame tree, replacing the
+  // RenderFrameProxy it is associated with.  Return value indicates whether
+  // the swap operation succeeded.  This should only be used for provisional
+  // frames associated with a proxy, while the proxy is still in the frame
+  // tree.  If the associated proxy has been detached before this is called,
+  // this returns false and aborts the swap.
+  bool SwapIn();
+
   // IPC message handlers ------------------------------------------------------
   //
   // The documentation for these functions should be in
@@ -797,6 +805,7 @@ class CONTENT_EXPORT RenderFrameImpl
                   const StartNavigationParams& start_params,
                   const RequestNavigationParams& request_params);
   void OnBeforeUnload(bool is_reload);
+  void OnSwapIn();
   void OnSwapOut(int proxy_routing_id,
                  bool is_loading,
                  const FrameReplicationState& replicated_frame_state);