Cleanup swapped out RenderViewHosts when the process goes away.

content/browser/web_contents/render_view_host_manager_unittest.cc

Index: content/browser/web_contents/render_view_host_manager_unittest.cc
diff --git a/content/browser/web_contents/render_view_host_manager_unittest.cc b/content/browser/web_contents/render_view_host_manager_unittest.cc
index 741230e1b0b9eb17d13dc065728c94a3f89e0222..7bfcd2f2ade17a232d5dbe8e5ec3923f1a722643 100644
--- a/content/browser/web_contents/render_view_host_manager_unittest.cc
+++ b/content/browser/web_contents/render_view_host_manager_unittest.cc
@@ -11,8 +11,10 @@
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/notification_details.h"
+#include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/notification_types.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_ui_controller.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/javascript_message_type.h"
@@ -939,6 +941,43 @@ TEST_F(RenderViewHostManagerTest, CreateSwappedOutOpenerRVHs) {
                    rvh3->GetSiteInstance()));
 }
 
+// Test that we clean up swapped out RenderViewHosts when a process hosting
+// those associated RenderViews crashes. http://crbug.com/258993
+TEST_F(RenderViewHostManagerTest, CleanUpSwappedOutRVHOnProcessCrash) {
+  const GURL kUrl1("http://www.google.com/");
+
+  // Navigate to an initial URL.
+  contents()->NavigateAndCommit(kUrl1);
+  TestRenderViewHost* rvh1 = test_rvh();
+
+  // Create a new tab as an opener for the main tab.
+  scoped_ptr<TestWebContents> opener1(
+      TestWebContents::Create(browser_context(), rvh1->GetSiteInstance()));
+  RenderViewHostManager* opener1_manager =
+      opener1->GetRenderManagerForTesting();
+  contents()->SetOpener(opener1.get());
+
+  EXPECT_FALSE(opener1_manager->GetSwappedOutRenderViewHost(
+      rvh1->GetSiteInstance()));
+  opener1->CreateSwappedOutRenderView(rvh1->GetSiteInstance());

[Charlie Reis, 2013/07/10 21:10:39]

Wait, this is the same SiteInstance as opener1's current RVH.  That should be
illegal-- we should never have a swapped out RVH in the same SiteInstance as
that tab's current RVH.  That would break if we try to swap out the current one,
since they're keyed by SiteInstance ID.

I'll put together a separate CL to fix it.

[Fady Samuel, 2013/07/10 21:27:33]

Heh, a bit of copy-pasta, I didn't notice. Thanks for catching this.

+  EXPECT_TRUE(opener1_manager->GetSwappedOutRenderViewHost(
+      rvh1->GetSiteInstance()));
+
+  // Fake a process crash.
+  RenderProcessHost::RendererClosedDetails details(
+      rvh1->GetProcess()->GetHandle(),
+      base::TERMINATION_STATUS_PROCESS_CRASHED,
+      0);
+  NotificationService::current()->Notify(
+      NOTIFICATION_RENDERER_PROCESS_CLOSED,
+      Source<RenderProcessHost>(rvh1->GetProcess()),
+      Details<RenderProcessHost::RendererClosedDetails>(&details));
+
+  // Ensure that the swapped out RenderViewHost has been deleted.
+  EXPECT_FALSE(opener1_manager->GetSwappedOutRenderViewHost(
+      rvh1->GetSiteInstance()));
+}
+
 // Test that RenderViewHosts created for WebUI navigations are properly
 // granted WebUI bindings even if an unprivileged swapped out RenderViewHost
 // is in the same process (http://crbug.com/79918).