Loosen the criteria for ValidateSpeculativeRenderFrameHostForBug1146573.

https://crrev.com/c/2532535 added a DumpWithoutCrashing but it was
triggering on cases that were unrelated to the bug. It was reverted to
keep it out of M88.

https://crrev.com/c/2538863 readded the debugging, this time called from
2 more places and excluding crashed frames.

This has led to no DWOC reports (while the original crash continues).
This seems to imply that crashed frames are actually involved.

This CL allows the DWOC to happen on crashed frames again. It removes
the call from CreateSpeculativeRenderFrameHost because that is expected
to involve crashed frames sometimes.


Bug: 1146573
Change-Id: I9a8e34825bbdb89468916947d56532d1da217269
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2557859
Commit-Queue: Nasko Oskov <nasko@chromium.org>
Auto-Submit: Fergal Daly <fergal@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#830845}

content/browser/renderer_host/render_frame_host_manager.cc

@@ -704,8 +704,6 @@ void RenderFrameHostManager::ValidateSpeculativeRenderFrameHostForBug1146573() {
   // This can happen during destruction after the RFH has been cleared.
   if (!render_frame_host_)
     return;
-  if (render_frame_host_->must_be_replaced())
-    return;
   if (!speculative_render_frame_host_)
     return;
   if (speculative_render_frame_host_->GetSiteInstance() ==
@@ -722,7 +720,9 @@ void RenderFrameHostManager::ValidateSpeculativeRenderFrameHostForBug1146573() {
     SCOPED_CRASH_KEY_STRING256(
         ValidateSpeculative, NewSiteInstance,
         speculative_render_frame_host_->GetSiteInstance()->GetSiteURL().spec());
-    DCHECK(false);
+    SCOPED_CRASH_KEY_BOOL(ValidateSpeculative, MustBeReplaced,
+                          render_frame_host_->must_be_replaced());
+    NOTREACHED();
     base::debug::DumpWithoutCrashing();
   }
 }
@@ -2394,7 +2394,6 @@ bool RenderFrameHostManager::CreateSpeculativeRenderFrameHost(
 
   speculative_render_frame_host_ = CreateSpeculativeRenderFrame(
       new_instance, recovering_without_early_commit);
-  ValidateSpeculativeRenderFrameHostForBug1146573();
 
   // If RenderViewHost was created along with the speculative RenderFrameHost,
   // ensure that RenderViewCreated is fired for it.  It is important to do this