Don't leave a RenderFrameProxyHost for the current RenderFrameHost.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index cb8148ca3d9486fa26f3fdadf70a5a0cf17cd3d4..cd262cb53f301586a9413bc440a9520f657fb43f 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -529,12 +529,7 @@ void RenderFrameHostManager::SwapOutOldPage() {
   // Create the RenderFrameProxyHost that will replace the
   // RenderFrameHost which is swapping out. If one exists, ensure it is deleted
   // from the map and not leaked.
-  RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(
-      render_frame_host_->GetSiteInstance()->GetId());
-  if (iter != proxy_hosts_.end()) {
-    delete iter->second;
-    proxy_hosts_.erase(iter);
-  }
+  DeleteRenderFrameProxyHost(render_frame_host_->GetSiteInstance());
 
   RenderFrameProxyHost* proxy = new RenderFrameProxyHost(
       render_frame_host_->GetSiteInstance(), frame_tree_node_);
@@ -1457,6 +1452,14 @@ RenderFrameHostImpl* RenderFrameHostManager::UpdateStateForNavigate(
 
   // Otherwise the same SiteInstance can be used.  Navigate render_frame_host_.
   DCHECK(!cross_navigation_pending_);
+
+  // It's possible to swap out the current RFH and then decide to navigate in it
+  // anyway (e.g., a cross-process navigation that redirects back to the
+  // original site).  In that case, we have a proxy for the current RFH but
+  // haven't deleted it yet.  The new navigation will swap it back in, so we can
+  // delete the proxy.
+  DeleteRenderFrameProxyHost(new_instance);
+
   if (ShouldReuseWebUI(current_entry, &entry)) {
     pending_web_ui_.reset();
     pending_and_current_web_ui_ = web_ui_->AsWeakPtr();
@@ -1591,4 +1594,13 @@ RenderFrameProxyHost* RenderFrameHostManager::GetRenderFrameProxyHost(
   return NULL;
 }
 
+void RenderFrameHostManager::DeleteRenderFrameProxyHost(
+    SiteInstance* instance) {
+  RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(instance->GetId());
+  if (iter != proxy_hosts_.end()) {
+    delete iter->second;
+    proxy_hosts_.erase(iter);
+  }
+}
+
 }  // namespace content