Make RenderFrameHostManagerTest.RemoveSubframeInUnload* more robust.

Add a dummy ExecJs at the end to ensure the crashing renderer is
reliably caught. E.g. https://crrev.com/c/2551883/5 is just rebased onto
this CL and is now (correctly) failing.

Also convert ExecuteScript to ExecJs which is the preferred helper.

Bug: 1148793,1111191
Change-Id: Ie70a49678a418d3c400d5a8394cf3e3fb1972b97
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2550330
Commit-Queue: Fergal Daly <fergal@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#829992}

content/browser/renderer_host/render_frame_host_manager_browsertest.cc

@@ -9094,6 +9094,10 @@ IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerTest,
 // See RemoveSubframeInUnload_SameSite
 IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerTest,
                        RemoveSubframeInUnload_CrossSite) {
+  // TODO(https://crbug.com/1148793): Remove this early return.
+  if (ShouldCreateNewHostForSameSiteSubframe() &&
+      !AreAllSitesIsolatedForTesting())
+    return;
   AssertCanRemoveSubframeInUnload(/*same_site=*/false);
 }
 
@@ -9108,7 +9112,7 @@ void RenderFrameHostManagerTest::AssertCanRemoveSubframeInUnload(
   ASSERT_TRUE(NavigateToURL(shell(), frame_url));
 
   // Set up the subframe's unload handler to remove the subframe.
-  ASSERT_TRUE(ExecuteScript(shell(), R"(
+  ASSERT_TRUE(ExecJs(shell(), R"(
     const subframe = document.getElementById("child-0");
     subframe.contentWindow.onunload = () => {
       subframe.remove();
@@ -9135,6 +9139,9 @@ void RenderFrameHostManagerTest::AssertCanRemoveSubframeInUnload(
 
   // The subframe has been removed.
   EXPECT_EQ(0UL, web_contents->GetMainFrame()->child_count());
+  // TODO(https://crbug.com/1111191): Remove this. Without this, the crash in
+  // the renderer in https://crbug.com/1148793 is usually not caught.
+  ASSERT_TRUE(ExecJs(shell(), ""));
 }
 
 INSTANTIATE_TEST_SUITE_P(All,