Index: content/browser/frame_host/frame_tree.cc |
diff --git a/content/browser/frame_host/frame_tree.cc b/content/browser/frame_host/frame_tree.cc |
index 183ccde1a7e2445923bdffa245ec137a8fd51aa0..26335fd4b27c78a181bab3f77b2611e879e41186 100644 |
--- a/content/browser/frame_host/frame_tree.cc |
+++ b/content/browser/frame_host/frame_tree.cc |
@@ -150,6 +150,8 @@ RenderFrameHostImpl* FrameTree::AddFrame(FrameTreeNode* parent, |
// it is in the same SiteInstance as the parent frame. Ensure that the process |
// which requested a child frame to be added is the same as the process of the |
// parent node. |
+ // We return nullptr if this is not the case, which can happen in a race if an |
+ // old RFH sends a CreateChildFrame message as we're swapping to a new RFH. |
if (parent->current_frame_host()->GetProcess()->GetID() != process_id) |
return nullptr; |