Ensure window reference is valid when navigating cross-process and back.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 894 matching lines @@
 
   if (render_frame_host) {
     // We won't be coming back, so delete this one.
     ShutdownProxiesIfLastActiveFrameInSiteInstance(render_frame_host.get());
     render_frame_host.reset();
   }
 }
 
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
-  // If this is the main frame going away, mark the corresponding
-  // RenderViewHost for deletion as well so that we don't try to reuse it.
-  if (render_frame_host->frame_tree_node()->IsMainFrame())
+  // If this is the main frame going away and there are no more references to
+  // its RenderViewHost, mark it for deletion as well so that we don't try to
+  // reuse it.

[nasko, 2015/09/30 21:44:06]

Yes.
 
The proxy that references the RVH needs to be replaced with a frame, which
happens by ::swap. In order for swap to happen though, we need to create new
frame that is associated with the same RenderView. Since we've put the RVH on
the pending_deletion_list_, we don't find it when we need it and create a new
one. This new one creates its own RenderFrame for the top level and we continue
on.

We didn't catch this before, because all of the tests we have do a brand new
window.open('', 'foo'), which ends up finding the new RenderFrame, while we have
a lingering reference to the old RenderFrameProxy. The moment we use that
reference, things explode. This is why my new test takes exactly this approach,
to ensure the actual JS reference remains valid.

+  if (render_frame_host->frame_tree_node()->IsMainFrame() &&
+      render_frame_host->render_view_host()->ref_count() <= 1) {
     render_frame_host->render_view_host()->set_pending_deletion();
+  }
 
   // |render_frame_host| will be deleted when its SwapOut ACK is received, or
   // when the timer times out, or when the RFHM itself is deleted (whichever
   // comes first).
   pending_delete_hosts_.push_back(
       linked_ptr<RenderFrameHostImpl>(render_frame_host.release()));
 }
 
 bool RenderFrameHostManager::IsPendingDeletion(
     RenderFrameHostImpl* render_frame_host) {
@@ skipping 1663 matching lines @@
 int RenderFrameHostManager::GetOpenerRoutingID(SiteInstance* instance) {
   if (!frame_tree_node_->opener())
     return MSG_ROUTING_NONE;
 
   return frame_tree_node_->opener()
       ->render_manager()
       ->GetRoutingIdForSiteInstance(instance);
 }
 
 }  // namespace content