GitLab

This CL fixes a bug where IsSwappedOut() always marked the RVH as
inactive and swapped-out.  This is incorrect in the case where the RVH
has been reused by another navigation that has already made it active.
The timing for that is hard to nail: usually, reusing a renderer
process for another navigation implies that the new navigation needs
to wait for a previous unload handler to finish running before a new
navigation can be started/committed.  However, if the navigation that
reuses the RVH is coming off of a cross-site sad tab page, it will
commit the pending RFH in the browser immediately, before the
navigation actually takes places in the renderer, which makes it
possible for a late swapout ACK from an unload handler to arrive after
CommitPending() has already marked the reused RVH as active.

Bug: 823567
Change-Id: I934ad70d3bd92d03f795291d603fb584f24b6c54
Reviewed-on: https://chromium-review.googlesource.com/971304
Commit-Queue: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Lucas Gadani <lfg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#544801}