Add CHECKs to decide between several theories on how we are crashing.

This will only trigger once I land https://crrev.com/c/2006890 but we
have no repro steps https://crbug.com/1014212 and are depending on crash
reports.

Check that:
- the RFH pointer is always replaced by a non-null pointer
- RFHI.frame_ is valid after we declare the RenderFrame to have been
  created
- RFHI.frame_ remains valid after all calls to SetUpMojoIfNeeded



Bug: 981339,1014212
Change-Id: Iab311832be80dcbe1a1ff431af551cdb3a3d645a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2010511
Commit-Queue: Fergal Daly <fergal@chromium.org>
Reviewed-by: Alexander Timin <altimin@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#733998}

content/browser/frame_host/cross_process_frame_connector.cc

@@ -334,6 +334,9 @@ void CrossProcessFrameConnector::OnVisibilityChanged(
   if (!view_)
     return;
 
+  // TODO(https://crbug.com/1014212) Remove this CHECK when the bug is fixed.
+  CHECK(
+      frame_proxy_in_parent_renderer_->frame_tree_node()->current_frame_host());
   frame_proxy_in_parent_renderer_->frame_tree_node()
       ->current_frame_host()
       ->VisibilityChanged(visibility);

content/browser/frame_host/render_frame_host_impl.cc

@@ -2163,6 +2163,9 @@ void RenderFrameHostImpl::SetRenderFrameCreated(bool created) {
       delegate_->RenderFrameDeleted(this);
     }
   }
+  // TODO(http://crbug.com/1014212): Change to DCHECK.
+  if (created)
+    CHECK(frame_);
 
   if (created && GetLocalRenderWidgetHost()) {
     mojo::PendingRemote<mojom::Widget> widget;
@@ -5786,6 +5789,9 @@ void RenderFrameHostImpl::SetUpMojoIfNeeded() {
   mojo::Remote<mojom::FrameFactory>(std::move(frame_factory))
       ->CreateFrame(routing_id_, frame_.BindNewPipeAndPassReceiver());
 
+  // TODO(http://crbug.com/1014212): Change to DCHECK.
+  CHECK(frame_);
+
   mojo::PendingRemote<service_manager::mojom::InterfaceProvider>
       remote_interfaces;
   frame_->GetInterfaceProvider(
@@ -7661,6 +7667,8 @@ void RenderFrameHostImpl::RemoveServiceWorkerContainerHost(
 }
 
 void RenderFrameHostImpl::UpdateFrameFrozenState() {
+  // TODO(http://crbug.com/1014212): remove this.
+  CHECK(frame_);
   if (!IsFeatureEnabled(
           blink::mojom::FeaturePolicyFeature::kExecutionWhileNotRendered) &&
       visibility_ == blink::mojom::FrameVisibility::kNotRendered) {

content/browser/frame_host/render_frame_host_manager.cc

@@ -2352,7 +2352,8 @@ void RenderFrameHostManager::CommitPending(
 
   // Swap in the new frame and make it active. Also ensure the FrameTree
   // stays in sync.
-  DCHECK(pending_rfh);
+  // TODO(http://crbug.com/1014212): Change to DCHECK.
+  CHECK(pending_rfh);
   std::unique_ptr<RenderFrameHostImpl> old_render_frame_host;
   old_render_frame_host = SetRenderFrameHost(std::move(pending_rfh));