Prevent creating a swapped out RVH in the same SiteInstance as the current one.

content/browser/frame_host/render_view_host_manager_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/render_view_host_manager.h"
 #include "content/browser/renderer_host/test_render_view_host.h"
 #include "content/browser/site_instance_impl.h"
@@ skipping 1074 matching lines @@
   EXPECT_FALSE(opener1_manager->GetSwappedOutRenderViewHost(
                    rvh3->GetSiteInstance()));
   EXPECT_FALSE(opener2_manager->GetSwappedOutRenderViewHost(
                    rvh3->GetSiteInstance()));
 }
 
 // Test that we clean up swapped out RenderViewHosts when a process hosting
 // those associated RenderViews crashes. http://crbug.com/258993
 TEST_F(RenderViewHostManagerTest, CleanUpSwappedOutRVHOnProcessCrash) {
   const GURL kUrl1("http://www.google.com/");
+  const GURL kUrl2("http://www.chromium.org/");
 
   // Navigate to an initial URL.
   contents()->NavigateAndCommit(kUrl1);
   TestRenderViewHost* rvh1 = test_rvh();
 
   // Create a new tab as an opener for the main tab.
   scoped_ptr<TestWebContents> opener1(
       TestWebContents::Create(browser_context(), rvh1->GetSiteInstance()));
   RenderViewHostManager* opener1_manager =
       opener1->GetRenderManagerForTesting();
   contents()->SetOpener(opener1.get());
 
+  // Make sure the new opener RVH is considered live.
+  opener1_manager->current_host()->CreateRenderView(string16(), -1, -1);
+
+  // Use a cross-process navigation in the opener to swap out the old RVH.
   EXPECT_FALSE(opener1_manager->GetSwappedOutRenderViewHost(
       rvh1->GetSiteInstance()));
-  opener1->CreateSwappedOutRenderView(rvh1->GetSiteInstance());
+  opener1->NavigateAndCommit(kUrl2);
   EXPECT_TRUE(opener1_manager->GetSwappedOutRenderViewHost(
       rvh1->GetSiteInstance()));
 
   // Fake a process crash.
   RenderProcessHost::RendererClosedDetails details(
       rvh1->GetProcess()->GetHandle(),
       base::TERMINATION_STATUS_PROCESS_CRASHED,
       0);
   NotificationService::current()->Notify(
       NOTIFICATION_RENDERER_PROCESS_CLOSED,
       Source<RenderProcessHost>(rvh1->GetProcess()),
       Details<RenderProcessHost::RendererClosedDetails>(&details));
   rvh1->set_render_view_created(false);
 
   // Ensure that the swapped out RenderViewHost has been deleted.
   EXPECT_FALSE(opener1_manager->GetSwappedOutRenderViewHost(
       rvh1->GetSiteInstance()));
 
-  // Reload the initial tab. This should recreate the opener.
+  // Reload the initial tab. This should recreate the opener's swapped out RVH
+  // in the original SiteInstance.
   contents()->GetController().Reload(true);
-
-  EXPECT_EQ(opener1_manager->current_host()->GetRoutingID(),
+  EXPECT_EQ(opener1_manager->GetSwappedOutRenderViewHost(
+                rvh1->GetSiteInstance())->GetRoutingID(),
             test_rvh()->opener_route_id());
 }
 
 // Test that RenderViewHosts created for WebUI navigations are properly
 // granted WebUI bindings even if an unprivileged swapped out RenderViewHost
 // is in the same process (http://crbug.com/79918).
 TEST_F(RenderViewHostManagerTest, EnableWebUIWithSwappedOutOpener) {
   set_should_create_webui(true);
   const GURL kSettingsUrl("chrome://chrome/settings");
   const GURL kPluginUrl("chrome://plugins");
@@ skipping 161 matching lines @@
                           Source<RenderWidgetHost>(host2));
   manager.ShouldClosePage(false, true, base::TimeTicks());
 
   EXPECT_TRUE(
       notifications.Check1AndReset(NOTIFICATION_RENDER_WIDGET_HOST_DESTROYED));
   EXPECT_FALSE(manager.pending_render_view_host());
   EXPECT_EQ(host, manager.current_host());
 }
 
 }  // namespace content