Set up Mojo connection when RenderFrameHost is reused for new RenderFrame

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 39799b9c099cbc9297567e14ea61886f554c1ae8..19e790617f40fdcfdcf8951d6bf6db5d89a529b2 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -186,6 +186,15 @@ RenderFrameHostImpl* RenderFrameHostManager::Navigate(
   // If the renderer crashed, then try to create a new one to satisfy this
   // navigation request.
   if (!dest_render_frame_host->IsRenderFrameLive()) {
+    // Instruct the destination render frame host to set up a Mojo connection
+    // with the new render frame if necessary.  Note that this call needs to
+    // occur before initializing the RenderView; the flow of creating the
+    // RenderView can cause browser-side code to execute that expects the this
+    // RFH's ServiceRegistry to be initialized (e.g., if the site is a WebUI
+    // site that is handled via Mojo, then Mojo WebUI code in //chrome will
+    // add a service to this RFH's ServiceRegistry).
+    dest_render_frame_host->SetUpMojoIfNeeded();
+
     // Recreate the opener chain.
     int opener_route_id = delegate_->CreateOpenerRenderViewsForRenderManager(
         dest_render_frame_host->GetSiteInstance());