Fix remote-to-local navigations in crashed subframes.

content/renderer/render_frame_impl.h

Index: content/renderer/render_frame_impl.h
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 2132cb23060fef2c33c36566932275c1b7763222..2206bd15bd3bd62336a23ce332dac919db5b7179 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -789,6 +789,13 @@ class CONTENT_EXPORT RenderFrameImpl
                                     blink::WebHistoryCommitType commit_type,
                                     const blink::WebHistoryItem& item);
 
+  // Swaps the current frame into the frame tree, replacing the
+  // RenderFrameProxy it is associated with.  Return value indicates whether
+  // the swap operation succeeded.  This should only be used for provisional
+  // frames associated with a proxy, while the proxy is still in the frame
+  // tree.

[Charlie Reis, 2017/01/12 00:29:05]

Might want to mention what happens if the proxy isn't found, since it could be
detached right before this IPC arrives.

[alexmos, 2017/01/12 01:38:12]

Done.

+  bool SwapIn();
+
   // IPC message handlers ------------------------------------------------------
   //
   // The documentation for these functions should be in
@@ -797,6 +804,7 @@ class CONTENT_EXPORT RenderFrameImpl
                   const StartNavigationParams& start_params,
                   const RequestNavigationParams& request_params);
   void OnBeforeUnload(bool is_reload);
+  void OnSwapIn();
   void OnSwapOut(int proxy_routing_id,
                  bool is_loading,
                  const FrameReplicationState& replicated_frame_state);