During a cross-process navigation, if the renderer navigates in an unload handler, we leak the process and leave the renderer/browser process out-of-sync. This happens because the browser has already added the RFH to the pending delete list, and created a new process/RFH for the next navigation.

Only in-page navigations are allowed in unload handlers, here's a test that reproduces the problem.

IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigateInUnloadHandler) {
  GURL main_url(embedded_test_server()->GetURL(
    "a.com", "/cross_site_iframe_factory.html?a(b(b))"));
  NavigateToURL(shell(), main_url);

  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
    ->GetFrameTree()
    ->root();

  EXPECT_EQ(
    " Site A ------------ proxies for B\n"
    "   +--Site B ------- proxies for A\n"
    "        +--Site B -- proxies for A\n"
    "Where A = http://a.com/\n"
    "      B = http://b.com/",
    DepictFrameTree(root));

  int child_count = 0;
  EXPECT_TRUE(ExecuteScriptAndExtractInt(
    root->child_at(0)->current_frame_host(),
    "window.domAutomationController.send(frames.length);", &child_count));
  EXPECT_EQ(1, child_count);

  EXPECT_TRUE(ExecuteScript(
    root->child_at(0)->child_at(0)->current_frame_host(),
    "window.onunload=function(e){\n"
    "    window.location = '#navigate';\n"
    "};\n"));
  std::string script =
    std::string("window.document.getElementById('child-0').src = \"") +
    embedded_test_server()
    ->GetURL("c.com", "/cross_site_iframe_factory.html?c")
    .spec() +
    "\"";
  EXPECT_TRUE(
    ExecuteScript(root->child_at(0)->current_frame_host(), script.c_str()));

  RenderFrameDeletedObserver deleted_observer(
    root->child_at(0)->child_at(0)->current_frame_host());
  deleted_observer.WaitUntilDeleted();

  EXPECT_TRUE(ExecuteScriptAndExtractInt(
    root->child_at(0)->current_frame_host(),
    "window.domAutomationController.send(frames.length);", &child_count));
  EXPECT_EQ(0, child_count);

  EXPECT_EQ(
    " Site A ------------ proxies for B\n"
    "   +--Site B ------- proxies for A\n"
    "Where A = http://a.com/\n"
    "      B = http://b.com/",
    DepictFrameTree(root));
}