Don't crash while detaching a pending child frame under --site-per-process.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 48 matching lines @@
       cross_navigation_pending_(false),
       render_frame_delegate_(render_frame_delegate),
       render_view_delegate_(render_view_delegate),
       render_widget_delegate_(render_widget_delegate),
       interstitial_page_(NULL),
       weak_factory_(this) {
   DCHECK(frame_tree_node_);
 }
 
 RenderFrameHostManager::~RenderFrameHostManager() {
-  if (pending_render_frame_host_)
-    CancelPending();
+  if (pending_render_frame_host_) {
+    pending_render_frame_host_->GetProcess()->RemovePendingView();

[nasko, 2014/12/11 23:49:53]

Don't we need the RenderViewDevToolsAgentHost::OnCancelPendingNavigation call
from CancelPending?

[ncarter (slow), 2014/12/12 20:21:06]

I thought about this. OnCancelPendingNavigation would switch the DevTool's
tracking back to the current view, which should then be deleted a couple lines
below. So it seemed like an unnecessary step.

[ncarter (slow), 2014/12/12 20:22:41]

Whoops -- I published the wrong comment. Meant to say I put it back in (out of
conservatism), which entailed extracting a helper function out of CancelPending.

+    pending_render_frame_host_.reset();

[nasko, 2014/12/11 23:49:54]

Does this need to be explicitly reset? If yes, it will be good to comment why.

[ncarter (slow), 2014/12/12 20:21:06]

I just wanted to preserve the existing relative destruction order, since it's
observer-visible.

+  }
 
   // We should always have a current RenderFrameHost except in some tests.
   SetRenderFrameHost(scoped_ptr<RenderFrameHostImpl>());
 
   // Delete any swapped out RenderFrameHosts.
   STLDeleteValues(&proxy_hosts_);
 }
 
 void RenderFrameHostManager::Init(BrowserContext* browser_context,
                                   SiteInstance* site_instance,
@@ skipping 1593 matching lines @@
 void RenderFrameHostManager::DeleteRenderFrameProxyHost(
     SiteInstance* instance) {
   RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(instance->GetId());
   if (iter != proxy_hosts_.end()) {
     delete iter->second;
     proxy_hosts_.erase(iter);
   }
 }
 
 }  // namespace content