Fix remote-to-local navigations in crashed subframes.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 6c55b6225e957b368f6288a9b47062fa286de7a0..bf211e5ff4d0ee39346657ac2190d729148be576 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -873,6 +873,18 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
       // complete. Just switch to the speculative RFH now and go back to normal.
       // (Note that we don't care about on{before}unload handlers if the current
       // RFH isn't live.)
+      //
+      // If the corresponding RenderFrame is currently associated with a proxy,
+      // send a SwapIn message to ensure that the RenderFrame swaps into the
+      // frame tree and replaces that proxy on the renderer side.  Normally
+      // this happens at navigation commit time, but in this case this must be
+      // done earlier to keep browser and renderer state in sync.  This is
+      // important to do before CommitPending(), which destroys the
+      // corresponding proxy. See https://crbug.com/487872.
+      if (GetRenderFrameProxyHost(dest_site_instance.get())) {
+        navigation_rfh->Send(
+            new FrameMsg_SwapIn(navigation_rfh->GetRoutingID()));
+      }
       CommitPending();
 
       // Notify the WebUI about the new RenderFrame if needed (the newly
@@ -2362,6 +2374,18 @@ RenderFrameHostImpl* RenderFrameHostManager::UpdateStateForNavigate(
       // navigate.  Just switch to the pending RFH now and go back to normal.
       // (Note that we don't care about on{before}unload handlers if the current
       // RFH isn't live.)
+      //
+      // If the corresponding RenderFrame is currently associated with a proxy,
+      // send a SwapIn message to ensure that the RenderFrame swaps into the
+      // frame tree and replaces that proxy on the renderer side.  Normally
+      // this happens at navigation commit time, but in this case this must be
+      // done earlier to keep browser and renderer state in sync.  This is
+      // important to do before CommitPending(), which destroys the
+      // corresponding proxy. See https://crbug.com/487872.
+      if (GetRenderFrameProxyHost(new_instance.get())) {
+        pending_render_frame_host_->Send(
+            new FrameMsg_SwapIn(pending_render_frame_host_->GetRoutingID()));
+      }
       CommitPending();
       return render_frame_host_.get();
     }