Ensure that before creating proxy of site A, RVH of site A is initialized.

content/browser/frame_host/frame_tree.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/frame_tree.h"
 
 #include <queue>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ skipping 186 matching lines @@
 
 void FrameTree::CreateProxiesForSiteInstance(
     FrameTreeNode* source,
     SiteInstance* site_instance) {
   // Create the swapped out RVH for the new SiteInstance. This will create
   // a top-level swapped out RFH as well, which will then be wrapped by a
   // RenderFrameProxyHost.
   if (!source->IsMainFrame()) {
     RenderViewHostImpl* render_view_host =
         source->frame_tree()->GetRenderViewHost(site_instance);
-    if (!render_view_host) {
+    if (!render_view_host || !render_view_host->IsRenderViewLive()) {
       root()->render_manager()->CreateRenderFrame(
           site_instance, nullptr, MSG_ROUTING_NONE,
           CREATE_RF_SWAPPED_OUT | CREATE_RF_HIDDEN, nullptr);
     }
   }
 
   scoped_refptr<SiteInstance> instance(site_instance);
 
   // Proxies are created in the FrameTree in response to a node navigating to a
   // new SiteInstance. Since |source|'s navigation will replace the currently
@@ skipping 40 matching lines @@
                                                     bool hidden) {
   DCHECK(main_frame_routing_id != MSG_ROUTING_NONE);
   RenderViewHostMap::iterator iter =
       render_view_host_map_.find(site_instance->GetId());
   if (iter != render_view_host_map_.end()) {
     // If a RenderViewHost's main frame is pending deletion for this
     // |site_instance|, put it in the map of RenderViewHosts pending shutdown.
     // Otherwise return the existing RenderViewHost for the SiteInstance.
     RenderFrameHostImpl* main_frame = static_cast<RenderFrameHostImpl*>(
         iter->second->GetMainFrame());
-    if (main_frame->frame_tree_node()->render_manager()->IsPendingDeletion(
-            main_frame)) {
+    // |main_frame| is NULL when the RVH is uninitialized.
+    if (main_frame &&
+            main_frame->frame_tree_node()->render_manager()->IsPendingDeletion(
+                main_frame)) {
       render_view_host_pending_shutdown_map_.insert(
           std::pair<int, RenderViewHostImpl*>(site_instance->GetId(),
                                               iter->second));
       render_view_host_map_.erase(iter);
     } else {
       return iter->second;

[lazyboy, 2014/12/11 01:29:48]

Trying to reuse the RVH fails after the frame tree replication CL landed,
because once we try to Initialize() this RVH, we want to access the main_frame's
replication_state():
https://code.google.com/p/chromium/codesearch#chromium/src/content/browser/re...
Also reusing would make RVH->main_frame_routing_id() point to incorrect id.

So I've changed the CL to create a new RVH in this case as well.

Now, this will insert the old RVH to render_view_host_pending_shutdown_map_, is
there any side-effect to that?

     }
   }
   RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
       RenderViewHostFactory::Create(site_instance,
                                     render_view_delegate_,
                                     render_widget_delegate_,
                                     routing_id,
                                     main_frame_routing_id,
                                     swapped_out,
                                     hidden));
@@ skipping 61 matching lines @@
         rvh->Shutdown();
         render_view_host_pending_shutdown_map_.erase(multi_iter);
       }
       break;
     }
     CHECK(render_view_host_found);
   }
 }
 
 }  // namespace content