PM: Cater for interface requests from speculative RenderFrameHosts.

This is a speculative fix for the crash in question. The assumption
is that the PerformanceManagerTabHelper is getting interface requests
for speculative RenderFrameHosts that it has no record of.

Bug: 987445
Change-Id: I7b35b4845b6b1b3cb84bb3d4efa85b782fcf2460
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1787886
Commit-Queue: François Doray <fdoray@chromium.org>
Reviewed-by: François Doray <fdoray@chromium.org>
Cr-Commit-Position: refs/heads/master@{#693937}

chrome/browser/performance_manager/performance_manager_tab_helper.cc

@@ -296,8 +296,25 @@ void PerformanceManagerTabHelper::OnInterfaceRequestFromFrame(
       resource_coordinator::mojom::DocumentCoordinationUnit::Name_)
     return;
 
+  // TODO(https://crbug.com/987445): Why else than due to speculative render
+  //     frame hosts would this happen? Is there a race between the RFH creation
+  //     notification and the mojo interface request?
   auto it = frames_.find(render_frame_host);
-  DCHECK(it != frames_.end());
+  if (it == frames_.end()) {
+    if (render_frame_host->IsRenderFrameCreated()) {
+      // This must be a speculative render frame host, generate a creation event
+      // for it a this point
+      RenderFrameCreated(render_frame_host);
+
+      it = frames_.find(render_frame_host);
+      DCHECK(it != frames_.end());
+    } else {
+      // It would be nice to know what's up here, maybe there's a race between
+      // in-progress interface requests and the frame deletion?
+      return;
+    }
+  }
+
   PostToGraph(FROM_HERE, &FrameNodeImpl::Bind, it->second.get(),
               resource_coordinator::mojom::DocumentCoordinationUnitRequest(
                   std::move(*interface_pipe)));