We currently have cases where the RenderViewHost is reused across navigations and some of its state might become stale. For example, if we navigate from A-embed-B to B, the swapped-out RVH for subframe B will be reused for the new page on B. After https://codereview.chromium.org/1886413002/, we will also allow reuse of a RVH from a pending delete RFH, leading to more such cases. The concern is that in these cases some of the RVH fields might become stale (enabled_bindings_, sudden_termination_allowed_, is_waiting_for_close_ack_, etc.). main_frame_routing_id_ is going to be stale until commit, though that currently doesn't cause anything to break. We should investigate these reuse issues further and watch out for bugs due to them. See the full discussion at https://codereview.chromium.org/1886413002/diff/180001/content/browser/frame_host/frame_tree.h#oldcode242
Comment 1 by sheriffbot@chromium.org
, Apr 27 2017Status: Untriaged (was: Available)