Don't crash while detaching a pending child frame under --site-per-process.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 06ab825123e4b1fd294dd577e6aee18ab9ff94fe..b5246f88a69b3ddf0e2a0613587c01cb6c79fc50 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -66,8 +66,10 @@ RenderFrameHostManager::RenderFrameHostManager(
 }
 
 RenderFrameHostManager::~RenderFrameHostManager() {
-  if (pending_render_frame_host_)
-    CancelPending();
+  if (pending_render_frame_host_) {
+    pending_render_frame_host_->GetProcess()->RemovePendingView();

[nasko, 2014/12/11 23:49:53]

Don't we need the RenderViewDevToolsAgentHost::OnCancelPendingNavigation call
from CancelPending?

[ncarter (slow), 2014/12/12 20:21:06]

I thought about this. OnCancelPendingNavigation would switch the DevTool's
tracking back to the current view, which should then be deleted a couple lines
below. So it seemed like an unnecessary step.

[ncarter (slow), 2014/12/12 20:22:41]

Whoops -- I published the wrong comment. Meant to say I put it back in (out of
conservatism), which entailed extracting a helper function out of CancelPending.

+    pending_render_frame_host_.reset();

[nasko, 2014/12/11 23:49:54]

Does this need to be explicitly reset? If yes, it will be good to comment why.

[ncarter (slow), 2014/12/12 20:21:06]

I just wanted to preserve the existing relative destruction order, since it's
observer-visible.

+  }
 
   // We should always have a current RenderFrameHost except in some tests.
   SetRenderFrameHost(scoped_ptr<RenderFrameHostImpl>());