Do not filter IPC messages until the new RVH commits, to avoid a race.

content/browser/tab_contents/render_view_host_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/tab_contents/render_view_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/logging.h"
@@ skipping 680 matching lines @@
         // handlers if the current RVH isn't live.)
         CommitPending();
         return render_view_host_;
       } else {
         NOTREACHED();
         return render_view_host_;
       }
     }
     // Otherwise, it's safe to treat this as a pending cross-site transition.
 
-    // It is possible that a previous cross-site navigation caused
-    // render_view_host_ to be swapped out and we are still waiting for
-    // the old pending_render_view_host_ to inform us about the committed
-    // navigation.
-    if (!render_view_host_->is_swapped_out()) {
-      // Make sure the old render view stops, in case a load is in progress.
-      render_view_host_->Send(
-          new ViewMsg_Stop(render_view_host_->routing_id()));
+    // Make sure the old render view stops, in case a load is in progress.
+    render_view_host_->Send(new ViewMsg_Stop(render_view_host_->routing_id()));
 
-      // Suspend the new render view (i.e., don't let it send the cross-site
-      // Navigate message) until we hear back from the old renderer's
-      // onbeforeunload handler.  If the handler returns false, we'll have to
-      // cancel the request.
-      DCHECK(!pending_render_view_host_->are_navigations_suspended());
-      pending_render_view_host_->SetNavigationsSuspended(true);
+    // Suspend the new render view (i.e., don't let it send the cross-site
+    // Navigate message) until we hear back from the old renderer's
+    // onbeforeunload handler.  If the handler returns false, we'll have to
+    // cancel the request.
+    DCHECK(!pending_render_view_host_->are_navigations_suspended());
+    pending_render_view_host_->SetNavigationsSuspended(true);
 
-      // Tell the CrossSiteRequestManager that this RVH has a pending cross-site
-      // request, so that ResourceDispatcherHost will know to tell us to run the
-      // old page's onunload handler before it sends the response.
-      pending_render_view_host_->SetHasPendingCrossSiteRequest(true, -1);
-
-      // Tell the old render view to run its onbeforeunload handler, since it
-      // doesn't otherwise know that the cross-site request is happening.  This
-      // will trigger a call to ShouldClosePage with the reply.
-      render_view_host_->FirePageBeforeUnload(true);
-    } else {
-      // As the render_view_host_ is already swapped out, we do not need
-      // to instruct it to run its beforeunload or unload handlers.  Therefore,
-      // we also do not need to suspend outgoing navigation messages and can
-      // just let the new pending_render_view_host_ immediately navigate.
-    }
+    // Tell the CrossSiteRequestManager that this RVH has a pending cross-site
+    // request, so that ResourceDispatcherHost will know to tell us to run the
+    // old page's onunload handler before it sends the response.
+    pending_render_view_host_->SetHasPendingCrossSiteRequest(true, -1);
 
     // We now have a pending RVH.
     DCHECK(!cross_navigation_pending_);
     cross_navigation_pending_ = true;
 
+    // Tell the old render view to run its onbeforeunload handler, since it
+    // doesn't otherwise know that the cross-site request is happening.  This
+    // will trigger a call to ShouldClosePage with the reply.
+    render_view_host_->FirePageBeforeUnload(true);
+
     return pending_render_view_host_;
   } else {
     if (pending_web_ui_.get() && render_view_host_->IsRenderViewLive())
       pending_web_ui_->GetController()->RenderViewReused(render_view_host_);
 
     // The renderer can exit view source mode when any error or cancellation
     // happen. We must overwrite to recover the mode.
     if (entry.IsViewSourceMode()) {
       render_view_host_->Send(
           new ViewMsg_EnableViewSourceMode(render_view_host_->routing_id()));
@@ skipping 64 matching lines @@
   }
 }
 
 bool RenderViewHostManager::IsSwappedOut(RenderViewHost* rvh) {
   if (!rvh->site_instance())
     return false;
 
   return swapped_out_hosts_.find(rvh->site_instance()->id()) !=
       swapped_out_hosts_.end();
 }