DescriptionFix SiteInstance ref counting issue in RenderFrameHostManager::CommitNavigation.
RenderFrameHostManager::CommitNavigation was not using scoped_refptr when it created a new SiteInstance. This resulted in the new SiteInstance being deleted in FrameTree::CreateProxiesForSiteInstance after iterating through the frame tree with base::Bind due to its ref count falling to 0.
This was the cause of crashes in RenderFrameHostManagerTest.BrowserSideNavigationCrossSiteNavigation and RenderFrameHostManagerTest.BrowserSideNavigationIgnoreStaleNavigationCommit under --site-per-process. These tests now pass.
BUG=417518
Committed: https://crrev.com/a175a7c2191008c6a03e63c451525e1e7ef3c437
Cr-Commit-Position: refs/heads/master@{#296584}
Patch Set 1 #
Messages
Total messages: 7 (2 generated)
|