Fix SiteInstance ref counting issue in RenderFrameHostManager::CommitNavigation.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 608 matching lines @@
   // active request.
   if (navigation_request_->navigation_request_id() !=
           info.navigation_request_id) {
     return;
   }
 
   // Pick the right RenderFrameHost to commit the navigation.
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
   // TODO(clamy): Replace the default values by the right ones. This may require
   // some storing in RequestNavigation.
-  SiteInstance* new_instance = GetSiteInstanceForNavigation(
+  scoped_refptr<SiteInstance> new_instance = GetSiteInstanceForNavigation(
       info.navigation_url,
       NULL,
       navigation_request_->info().navigation_params.transition_type,
       false,
       false);
   DCHECK(!pending_render_frame_host_.get());
 
   // TODO(clamy): Update how pending WebUI objects are handled.
-  if (current_instance != new_instance) {
+  if (current_instance != new_instance.get()) {
     CreateRenderFrameHostForNewSiteInstance(
-        current_instance, new_instance, frame_tree_node_->IsMainFrame());
+        current_instance, new_instance.get(), frame_tree_node_->IsMainFrame());
     DCHECK(pending_render_frame_host_.get());
     // TODO(clamy): Wait until the navigation has committed before swapping
     // renderers.
     scoped_ptr<RenderFrameHostImpl> old_render_frame_host =
         SetRenderFrameHost(pending_render_frame_host_.Pass());
     if (frame_tree_node_->IsMainFrame())
       render_frame_host_->render_view_host()->AttachToFrameTree();
   }
 
   // If the renderer that needs to navigate is not live (it was just created or
@@ skipping 1061 matching lines @@
 void RenderFrameHostManager::DeleteRenderFrameProxyHost(
     SiteInstance* instance) {
   RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(instance->GetId());
   if (iter != proxy_hosts_.end()) {
     delete iter->second;
     proxy_hosts_.erase(iter);
   }
 }
 
 }  // namespace content