Ignore InputMsg IPCs if RenderView is in swapped out state.

InputMsg IPCs are dispatched to the compositor thread when they arrive
in the renderer process. If not handled there, they are sent back to the
main thread. This behavior allows for IPCs that are processed on the
main thread to come in order different than the browser process has sent
them in.

The crash in 541578 occurs when InputMsg_SetFocus is sent right before
FrameMsg_SwapOut. On the renderer side, the InputMsg_SetFocus message is
sent to the compositor thread and in the meantime the FrameMsg_SwapOut
message is processed on the main thread. After swapping out is complete
the top-level frame for the swapped out RenderView becomes a RemoteFrame
when swapped out RenderFrameHost usage is disabled. This causes the
FocusController to return RemoteFrame and that violates assumptions
elsewhere in code that all focused frames are LocalFrame.

Overall, swapped out RenderView should not be processing input messages
at all, so this CL implements this restriction.

BUG=357747, 541578

Review URL: https://codereview.chromium.org/1408873002

Cr-Commit-Position: refs/heads/master@{#354426}
2 files changed