Fix SiteInstance ref counting issue in RenderFrameHostManager::CommitNavigation.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 52bd32f37601dc2185bb795d53305a4cc93df6cd..0663346d8ce240e2b519724cc500d4d0b7f5a644 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -626,7 +626,7 @@ void RenderFrameHostManager::CommitNavigation(
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
   // TODO(clamy): Replace the default values by the right ones. This may require
   // some storing in RequestNavigation.
-  SiteInstance* new_instance = GetSiteInstanceForNavigation(
+  scoped_refptr<SiteInstance> new_instance = GetSiteInstanceForNavigation(
       info.navigation_url,
       NULL,
       navigation_request_->info().navigation_params.transition_type,
@@ -635,9 +635,9 @@ void RenderFrameHostManager::CommitNavigation(
   DCHECK(!pending_render_frame_host_.get());
 
   // TODO(clamy): Update how pending WebUI objects are handled.
-  if (current_instance != new_instance) {
+  if (current_instance != new_instance.get()) {
     CreateRenderFrameHostForNewSiteInstance(
-        current_instance, new_instance, frame_tree_node_->IsMainFrame());
+        current_instance, new_instance.get(), frame_tree_node_->IsMainFrame());
     DCHECK(pending_render_frame_host_.get());
     // TODO(clamy): Wait until the navigation has committed before swapping
     // renderers.