1. Suppose renderer 1 is hosting frame A, so it has the LocalFrame for A. Some script makes a change, and renderer 1 queues an IPC to the browser process to update the replicated state.
2. Simultaneously, a cross-process navigation commits in renderer 2, so renderer 2 swaps from a RemoteFrame for A to the LocalFrame for A.
In the browser process, the RFH for frame A in renderer 1 is put in the pending delete list on swap and deleted after a second.
If the IPC reaches the RFH before it's deleted, then we can send the replicated state. But then we need to replicate it to renderer 2 (which now has a RFH, instead of a RFPH) for frame A. Doing this also makes things more complicated, because the replication code might need to understand that it only needs to re-replicate to a RFH if the active RFH changed.
On the other hand, if it reaches the browser, and the RFH is already gone, then the IPC just gets ignored, and we have inconsistent state between renderers.
One possibility is to use Mojo as the framework for replicating state: Mojo interfaces can be rebound, so the replication interface can be passed along easily. However, this introduces other issues, since generally, only the "active" RFH should be triggering changes in FrameReplicationState...
Another possibility is to force all state updates to require a round trip to the browser, but this introduces a sync IPC in paths we probably don't want it =(
Comment 1 by sheriffbot@chromium.org
, Feb 12 2018Status: Untriaged (was: Available)