commit e7d59816288ef3246defc4b86cb4e03e28d75956
author danakj <danakj@chromium.org> Wed May 15 18:14:50 2019
committer Commit Bot <commit-bot@chromium.org> Wed May 15 18:14:50 2019
tree 3f338b2ef516836329087ceb03b88a419f391119
parent 2bfeedf48342fc29dde839bf4d43b9c8fe146f3b

Handle race of SwapIn() and browser destroying the speculative MainFrame

When WebContentsImpl destroys, it deletes the speculative main frame,
but the renderer may have taken ownership of it already, and the notice
of such action is in flight to the browser still. This leads to DCHECKs
failing in the renderer. So inform the FrameMsg_Delete IPC what the
intention of the browser is, there are 3 modes:

- Deleting a non-main frame. This is the common case. These frames are
all owned by the browser so it's all good, no races.
- Deleting a speculative main frame at shutdown. This is the race we
address here.
- Deleting a speculative main frame because it's no longer needed. This
race is not handled by this CL but we CHECK() it explicitly now instead
of letting the renderer continue with a missing RenderFrame that it
expects to be present until it crashes somewhere random later.

R=avi@chromium.org, dcheng@chromium.org

Bug: 957858, 838348
Change-Id: I2110bdaf8b116df48037f69db6cb992fa3796e29
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1594834
Commit-Queue: danakj <danakj@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#660025}