r617771, Linux.

What steps will reproduce the problem?

(1) Build content_shell and run

$ ./third_party/blink/tools/run_web_tests.py --release external/wpt/upgrade-insecure-requests/

What is the expected result?

Tests pass.

What happens instead?

iframe-redirect-upgrade.https.html crashes for the first run (and passes on retry).
(So far 100% reproducible on my local Linux laptop).

This hits NOTREACHED() in FindRenderProcessesForSiteInstance().
Assigned to clamy@ based on the TODO comment there.

Please use labels and text to provide additional information.

Stack trace:

    #0 0x5623df509e21 in __interceptor_backtrace /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:4041:13
    #1 0x5623e8b9581f in base::debug::StackTrace::StackTrace(unsigned long) ./../../base/debug/stack_trace_posix.cc:820:41
    #2 0x5623e8904340 in logging::LogMessage::~LogMessage() ./../../base/logging.cc:592:29
    #3 0x5623e705836b in content::(anonymous namespace)::SiteProcessCountTracker::FindRenderProcessesForSiteInstance(content::SiteInstanceImpl*, std::__1::set<content::RenderProcessHost*, std::__1::less<content::RenderProcessHost*>, std::__1::allocator<content::RenderProcessHost*> >*, std::__1::set<content::RenderProcessHost*, std::__1::less<content::RenderProcessHost*>, std::__1::allocator<content::RenderProcessHost*> >*) ./../../content/browser/renderer_host/render_process_host_impl.cc:934:9
    #4 0x5623e70543c2 in content::RenderProcessHostImpl::FindReusableProcessHostForSiteInstance(content::SiteInstanceImpl*) ./../../content/browser/renderer_host/render_process_host_impl.cc:4533:22
    #5 0x5623e7051b1d in content::RenderProcessHostImpl::GetProcessHostForSiteInstance(content::SiteInstanceImpl*) ./../../content/browser/renderer_host/render_process_host_impl.cc:3979:11
    #6 0x5623e74f613a in content::SiteInstanceImpl::GetProcess() ./../../content/browser/site_instance_impl.cc:139:16
    #7 0x5623e6891989 in content::RenderFrameHostManager::CreateSpeculativeRenderFrameHost(content::SiteInstance*, content::SiteInstance*) ./../../content/browser/frame_host/render_frame_host_manager.cc:1723:22
    #8 0x5623e688f773 in content::RenderFrameHostManager::GetFrameHostForNavigation(content::NavigationRequest const&) ./../../content/browser/frame_host/render_frame_host_manager.cc:598:22
    #9 0x5623e67ad249 in content::NavigationRequest::OnResponseStarted(scoped_refptr<network::ResourceResponse> const&, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID const&, bool, content::NavigationDownloadPolicy, bool, base::Optional<content::SubresourceLoaderParams>) ./../../content/browser/frame_host/navigation_request.cc:1102:45
    #10 0x5623e6b58bb5 in content::NavigationURLLoaderImpl::OnReceiveResponse(scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID const&, bool, bool) ./../../content/browser/loader/navigation_url_loader_impl.cc:1805:14
    #11 0x5623e6b71a10 in void base::internal::FunctorTraits<void (content::NavigationURLLoaderImpl::*)(scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID const&, bool, bool), void>::Invoke<void (content::NavigationURLLoaderImpl::*)(scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID const&, bool, bool), base::WeakPtr<content::NavigationURLLoaderImpl>, scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID, bool, bool>(void (content::NavigationURLLoaderImpl::*)(scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID const&, bool, bool), base::WeakPtr<content::NavigationURLLoaderImpl>&&, scoped_refptr<network::ResourceResponse>&&, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>&&, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >&&, content::GlobalRequestID&&, bool&&, bool&&) ./../../base/bind_internal.h:516:12
    #12 0x5623e6b7166f in MakeItSo<void (content::NavigationURLLoaderImpl::*)(scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, const content::GlobalRequestID &, bool, bool), base::WeakPtr<content::NavigationURLLoaderImpl>, scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID, bool, bool> ./../../base/bind_internal.h:636:5
    #13 0x5623e6b7166f in RunImpl<void (content::NavigationURLLoaderImpl::*)(scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, const content::GlobalRequestID &, bool, bool), std::__1::tuple<base::WeakPtr<content::NavigationURLLoaderImpl>, scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID, bool, bool>, 0, 1, 2, 3, 4, 5, 6> ./../../base/bind_internal.h:689:0
    #14 0x5623e6b7166f in base::internal::Invoker<base::internal::BindState<void (content::NavigationURLLoaderImpl::*)(scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID const&, bool, bool), base::WeakPtr<content::NavigationURLLoaderImpl>, scoped_refptr<network::ResourceResponse>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__1::unique_ptr<content::NavigationData, std::__1::default_delete<content::NavigationData> >, content::GlobalRequestID, bool, bool>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/bind_internal.h:658:0
    #15 0x5623e8939874 in Run ./../../base/callback.h:99:12
    #16 0x5623e8939874 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ./../../base/debug/task_annotator.cc:99:0
    #17 0x5623e8934c26 in base::MessageLoopImpl::RunTask(base::PendingTask*) ./../../base/message_loop/message_loop_impl.cc:374:46
    #18 0x5623e893639a in DeferOrRunPendingTask ./../../base/message_loop/message_loop_impl.cc:385:5
    #19 0x5623e893639a in base::MessageLoopImpl::DoWork() ./../../base/message_loop/message_loop_impl.cc:473:0
    #20 0x5623e8942297 in HandleDispatch ./../../base/message_loop/message_pump_glib.cc:263:25
    #21 0x5623e8942297 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) ./../../base/message_loop/message_pump_glib.cc:109:0
    #22 0x7fc14e3eefc7 in g_main_context_dispatch ??:0:0
    #23 0x7fc14e3ef200 in g_main_context_dispatch ??:?
    #24 0x7fc14e3ef200 in ?? ??:0
    #25 0x7fc14e3ef28c in g_main_context_iteration ??:0:0
    #26 0x5623e8941846 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_glib.cc:305:30
    #27 0x5623e89339e6 in base::MessageLoopImpl::Run(bool) ./../../base/message_loop/message_loop_impl.cc:326:12
    #28 0x5623e89c07eb in base::RunLoop::Run() ./../../base/run_loop.cc:102:14
    #29 0x5623e6122587 in content::BrowserMainLoop::MainMessageLoopRun() ./../../content/browser/browser_main_loop.cc:1546:12
    #30 0x5623e6121e88 in content::BrowserMainLoop::RunMainMessageLoopParts() ./../../content/browser/browser_main_loop.cc:1002:5
    #31 0x5623e612ac57 in content::BrowserMainRunnerImpl::Run() ./../../content/browser/browser_main_runner_impl.cc:165:15
    #32 0x5623e874dbf9 in RunOneTest ./../../content/shell/browser/web_test/web_test_browser_main.cc:62:16
    #33 0x5623e874dbf9 in RunTests ./../../content/shell/browser/web_test/web_test_browser_main.cc:94:0
    #34 0x5623e874dbf9 in WebTestBrowserMain(content::MainFunctionParams const&, std::__1::unique_ptr<content::BrowserMainRunner, std::__1::default_delete<content::BrowserMainRunner> > const&) ./../../content/shell/browser/web_test/web_test_browser_main.cc:154:0
    #35 0x5623e86ed95e in content::ShellMainDelegate::RunProcess(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, content::MainFunctionParams const&) ./../../content/shell/app/shell_main_delegate.cc:370:16
    #36 0x5623e5cc7e89 in RunBrowserProcessMain ./../../content/app/content_main_runner_impl.cc:535:29
    #37 0x5623e5cc7e89 in content::ContentMainRunnerImpl::RunServiceManager(content::MainFunctionParams&, bool) ./../../content/app/content_main_runner_impl.cc:954:0
    #38 0x5623e5cc71f5 in content::ContentMainRunnerImpl::Run(bool) ./../../content/app/content_main_runner_impl.cc:868:12
    #39 0x5623ee0fb21c in service_manager::Main(service_manager::MainParams const&) ./../../services/service_manager/embedder/main.cc:460:29
    #40 0x5623e291abb3 in content::ContentMain(content::ContentMainParams const&) ./../../content/app/content_main.cc:19:10
    #41 0x5623df593cac in main ./../../content/shell/app/shell_main.cc:39:10
    #42 0x7fc148d742b1 in __libc_start_main ??:0:0
    #43 0x5623df4bc02a in _start ??:0:0