Drop CreateChildFrame messages when swapping out.

content/browser/frame_host/frame_tree.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/frame_tree.h"
 
 #include <queue>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ skipping 125 matching lines @@
     queue.pop();
     if (!on_node.Run(node))
       break;
 
     for (size_t i = 0; i < node->child_count(); ++i)
       queue.push(node->child_at(i));
   }
 }
 
 RenderFrameHostImpl* FrameTree::AddFrame(FrameTreeNode* parent,
+                                         int process_id,
                                          int new_routing_id,
                                          const std::string& frame_name) {
+  // A child frame always starts with an initial empty document, which means
+  // it is in the same SiteInstance as the parent frame. Ensure that the process
+  // which requested a child frame to be added is the same as the process of the
+  // parent node.
+  if (parent->current_frame_host()->GetProcess()->GetID() != process_id)
+    return nullptr;
+
   scoped_ptr<FrameTreeNode> node(new FrameTreeNode(
       this, parent->navigator(), render_frame_delegate_, render_view_delegate_,
       render_widget_delegate_, manager_delegate_, frame_name));
   std::pair<FrameTreeNodeIDMap::iterator, bool> result =
       g_frame_tree_node_id_map.Get().insert(
           std::make_pair(node->frame_tree_node_id(), node.get()));
   CHECK(result.second);
   FrameTreeNode* node_ptr = node.get();
   // AddChild is what creates the RenderFrameHost.
   parent->AddChild(node.Pass(), new_routing_id);

[Charlie Reis, 2014/10/16 17:22:11]

Can we add process_id to this call as well, just to CHECK that it's equal to
render_manager_.current_host()->GetProcess()->GetID()?  I don't want future
callers of that function to make the same mistake.

[nasko, 2014/10/16 17:41:30]

Done.

   return node_ptr->current_frame_host();
 }
 
 void FrameTree::RemoveFrame(FrameTreeNode* child) {
   FrameTreeNode* parent = child->parent();
   if (!parent) {
     NOTREACHED() << "Unexpected RemoveFrame call for main frame.";
     return;
   }
 
@@ skipping 156 matching lines @@
         rvh->Shutdown();
         render_view_host_pending_shutdown_map_.erase(multi_iter);
       }
       break;
     }
     CHECK(render_view_host_found);
   }
 }
 
 }  // namespace content