Drop CreateChildFrame messages when swapping out.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
@@ skipping 593 matching lines @@
       HasWebUIScheme(delegate_->GetMainFrameLastCommittedURL()) ? level : 0;
 
   if (resolved_level >= ::logging::GetMinLogLevel()) {
     logging::LogMessage("CONSOLE", line_no, resolved_level).stream() << "\"" <<
         message << "\", source: " << source_id << " (" << line_no << ")";
   }
 }
 
 void RenderFrameHostImpl::OnCreateChildFrame(int new_routing_id,
                                              const std::string& frame_name) {
+  // It is possible that while a new RenderFrameHost was committed, the
+  // RenderFrame corresponding to this host sent an IPC message to create a
+  // frame and it is delivered after this host is swapped out.
+  // Ignore such messages, as we know this RenderFrameHost is going away.
+  if (rfh_state_ != RenderFrameHostImpl::STATE_DEFAULT)
+    return;
+
   RenderFrameHostImpl* new_frame = frame_tree_->AddFrame(

[Charlie Reis, 2014/10/15 23:54:18]

FrameTree::AddFrame is still a problematic API, in my opinion.  It assumes the
new_routing_id is from the current process, and that turns out to be easy to
violate.  We should make it take in both a process ID and the routing ID, so
that we can verify we're using the right process internally.

It's fine to do that in a follow-up CL if you'd prefer, since I think this is
the only call-site and there shouldn't be a way for the process to be different
while this RFH not in the default state.  Might be nice to get it done all at
once, though.

[nasko, 2014/10/16 17:08:36]

No need for follow up CL. Let's do it right from the beginning.

       frame_tree_node_, new_routing_id, frame_name);
 
   // We know that the RenderFrame has been created in this case, immediately
   // after the CreateChildFrame IPC was sent.
   new_frame->set_render_frame_created(true);
 
   if (delegate_)
     delegate_->RenderFrameCreated(new_frame);
 }
 
@@ skipping 932 matching lines @@
   // Clear any state if a pending navigation is canceled or preempted.
   if (suspended_nav_params_)
     suspended_nav_params_.reset();
 
   TRACE_EVENT_ASYNC_END0("navigation",
                          "RenderFrameHostImpl navigation suspended", this);
   navigations_suspended_ = false;
 }
 
 }  // namespace content