DescriptionDrop CreateChildFrame messages when swapping out.
There is a race condition in the current state of the code where in cross-process navigation we swap the existing RenderFrameHost with a new RenderFrameHost. If the existing host sends an IPC message to create a new child frame, it arrives on the IO thread, allocates a routing id based of the existing process (p1) and does a PostTask to the UI thread. If there is a CommitPending event either executing on the UI thread or in the task queue before the task posted from the IO thread, it will end up putting the existing RenderFrameHost in swapped out state (or waiting for swapped out). When the task to create a child frame is executed after that, it creates a new RenderFrameHost, but it uses the "current" process (p2), which is different than the process that sent the message (p1). This manifests sometimes as adding duplicate routing ids to RenderProcessHost and is in general really bad bug.
BUG=415059, 423691, 381990
Committed: https://crrev.com/dcdb02fab210ec5f7b8b560075ce96d0f48f344c
Cr-Commit-Position: refs/heads/master@{#299939}
Patch Set 1 #
Total comments: 10
Patch Set 2 : Fixes based on Charlie's review. #
Total comments: 4
Patch Set 3 : Another round of fixes. #
Messages
Total messages: 12 (2 generated)
|