9 files changed, 61 insertions, 4 deletions

diff --git a/chrome/browser/instant/instant_browsertest.cc b/chrome/browser/instant/instant_browsertest.cc
index ce147fe..ca9a0b8 100644
--- a/chrome/browser/instant/instant_browsertest.cc
+++ b/chrome/browser/instant/instant_browsertest.cc
@@ -24,7 +24,9 @@
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "content/public/browser/notification_service.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/result_codes.h"
 #include "content/public/test/browser_test_utils.h"
 #include "grit/generated_resources.h"
 #include "ui/base/l10n/l10n_util.h"
@@ -91,6 +93,13 @@ class InstantTest : public InProcessBrowserTest {
     return browser()->window()->GetLocationBar()->GetLocationEntry();
   }
 
+  void KillInstantRenderView() {
+    base::KillProcess(
+        instant()->GetPreviewContents()->GetRenderProcessHost()->GetHandle(),
+        content::RESULT_CODE_KILLED,
+        false);
+  }
+
   void FocusOmnibox() {
     // If the omnibox already has focus, just notify Instant.
     if (omnibox()->model()->has_focus())
@@ -1059,3 +1068,20 @@ IN_PROC_BROWSER_TEST_F(InstantTest, SuggestionsAreReusable) {
   SetOmniboxText("insane");
   EXPECT_EQ(ASCIIToUTF16(""), omnibox()->GetInstantSuggestion());
 }
+
+// Test that instant loader is recreated if it gets destroyed.
+IN_PROC_BROWSER_TEST_F(InstantTest, InstantRenderViewGone) {
+  ASSERT_NO_FATAL_FAILURE(SetupInstant());
+  FocusOmniboxAndWaitForInstantSupport();
+
+  // Type partial query, get suggestion to show.
+  SetOmniboxTextAndWaitForInstantToShow("q");
+  EXPECT_EQ(ASCIIToUTF16("query suggestion"), omnibox()->GetText());
+
+  // Kill the instant renderer and wait for instant support again.
+  KillInstantRenderView();
+  FocusOmniboxAndWaitForInstantSupport();
+
+  SetOmniboxTextAndWaitForInstantToShow("qu");
+  EXPECT_EQ(ASCIIToUTF16("query suggestion"), omnibox()->GetText());
+}
diff --git a/chrome/browser/instant/instant_client.cc b/chrome/browser/instant/instant_client.cc
index eb045bc..8aa53fb 100644
--- a/chrome/browser/instant/instant_client.cc
+++ b/chrome/browser/instant/instant_client.cc
@@ -97,6 +97,10 @@ bool InstantClient::OnMessageReceived(const IPC::Message& message) {
   return handled;
 }
 
+void InstantClient::RenderViewGone(base::TerminationStatus status) {
+  delegate_->RenderViewGone();
+}
+
 void InstantClient::SetSuggestions(
     int page_id,
     const std::vector<InstantSuggestion>& suggestions) {
diff --git a/chrome/browser/instant/instant_client.h b/chrome/browser/instant/instant_client.h
index 95ab909..c22a0a6 100644
--- a/chrome/browser/instant/instant_client.h
+++ b/chrome/browser/instant/instant_client.h
@@ -58,6 +58,9 @@ class InstantClient : public content::WebContentsObserver {
     // strokes.
     virtual void StopCapturingKeyStrokes() = 0;
 
+    // Called when the underlying RenderView crashes.
+    virtual void RenderViewGone() = 0;
+
    protected:
     virtual ~Delegate();
   };
@@ -123,6 +126,7 @@ class InstantClient : public content::WebContentsObserver {
       bool is_main_frame,
       content::RenderViewHost* render_view_host) OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
+  virtual void RenderViewGone(base::TerminationStatus status) OVERRIDE;
 
   void SetSuggestions(int page_id,
                       const std::vector<InstantSuggestion>& suggestions);
diff --git a/chrome/browser/instant/instant_controller.cc b/chrome/browser/instant/instant_controller.cc
index 1e63886..02e2c0d 100644
--- a/chrome/browser/instant/instant_controller.cc
+++ b/chrome/browser/instant/instant_controller.cc
@@ -766,6 +766,15 @@ void InstantController::InstantLoaderContentsFocused() {
 #endif
 }
 
+void InstantController::InstantLoaderRenderViewGone() {
+  ++blacklisted_urls_[loader_->instant_url()];
+  HideInternal();
+  delete loader_->ReleaseContents();
+  // Delay deletion as we have gotten here from an InstantLoader method.
+  MessageLoop::current()->DeleteSoon(FROM_HERE, loader_.release());
+  CreateDefaultLoader();
+}
+
 bool InstantController::ResetLoader(const TemplateURL* template_url,
                                     const content::WebContents* active_tab) {
   std::string instant_url;
diff --git a/chrome/browser/instant/instant_controller.h b/chrome/browser/instant/instant_controller.h
index 34e78ab..5661ba1 100644
--- a/chrome/browser/instant/instant_controller.h
+++ b/chrome/browser/instant/instant_controller.h
@@ -142,6 +142,9 @@ class InstantController {
   // user clicking on it.
   void InstantLoaderContentsFocused();
 
+  // Invoked by the InstantLoader when its RenderView crashes.
+  void InstantLoaderRenderViewGone();
+
  private:
   FRIEND_TEST_ALL_PREFIXES(InstantTest, OmniboxFocusLoadsInstant);
   FRIEND_TEST_ALL_PREFIXES(InstantTest, NonInstantSearchProvider);
@@ -256,10 +259,11 @@ class InstantController {
   base::OneShotTimer<InstantController> stale_loader_timer_;
 
   // For each key K => value N, the map says that we found that the search
-  // engine identified by Instant URL K didn't support the Instant API in each
-  // of the last N times that we loaded it. If an Instant URL isn't present in
-  // the map at all or has a value 0, it means that search engine supports the
-  // Instant API (or we assume it does, since we haven't determined it doesn't).
+  // engine identified by Instant URL K didn't support the Instant API, or
+  // caused RenderView crashes in each of the last N times that we loaded it.
+  // If an Instant URL isn't present in the map at all or has a value 0,
+  // it means that search engine supports the Instant API (or we assume it does,
+  // since we haven't determined it doesn't) and it did not cause a crash.
   std::map<std::string, int> blacklisted_urls_;
 
   // Search terms extraction (for autocomplete history matches) doesn't work
diff --git a/chrome/browser/instant/instant_loader.cc b/chrome/browser/instant/instant_loader.cc
index f8debd2..e6f2b79 100644
--- a/chrome/browser/instant/instant_loader.cc
+++ b/chrome/browser/instant/instant_loader.cc
@@ -291,6 +291,10 @@ void InstantLoader::StopCapturingKeyStrokes() {
   // focus) doesn't require doing anything explicitly here.
 }
 
+void InstantLoader::RenderViewGone() {
+  controller_->InstantLoaderRenderViewGone();
+}
+
 void InstantLoader::Observe(int type,
                             const content::NotificationSource& source,
                             const content::NotificationDetails& details) {
diff --git a/chrome/browser/instant/instant_loader.h b/chrome/browser/instant/instant_loader.h
index a605f37..458e5c6 100644
--- a/chrome/browser/instant/instant_loader.h
+++ b/chrome/browser/instant/instant_loader.h
@@ -114,6 +114,7 @@ class InstantLoader : public InstantClient::Delegate,
                                   InstantSizeUnits units) OVERRIDE;
   virtual void StartCapturingKeyStrokes() OVERRIDE;
   virtual void StopCapturingKeyStrokes() OVERRIDE;
+  virtual void RenderViewGone() OVERRIDE;
 
   // Overridden from content::NotificationObserver:
   virtual void Observe(int type,
diff --git a/chrome/browser/instant/instant_tab.cc b/chrome/browser/instant/instant_tab.cc
index 2308563..49970d6 100644
--- a/chrome/browser/instant/instant_tab.cc
+++ b/chrome/browser/instant/instant_tab.cc
@@ -75,3 +75,7 @@ void InstantTab::StartCapturingKeyStrokes() {
 void InstantTab::StopCapturingKeyStrokes() {
   // We don't honor this call from committed tabs.
 }
+
+void InstantTab::RenderViewGone() {
+  // For a commit page, a crash should not be handled differently.
+}
diff --git a/chrome/browser/instant/instant_tab.h b/chrome/browser/instant/instant_tab.h
index 9af7b13..0f9bae3 100644
--- a/chrome/browser/instant/instant_tab.h
+++ b/chrome/browser/instant/instant_tab.h
@@ -54,6 +54,7 @@ class InstantTab : public InstantClient::Delegate {
                                   InstantSizeUnits units) OVERRIDE;
   virtual void StartCapturingKeyStrokes() OVERRIDE;
   virtual void StopCapturingKeyStrokes() OVERRIDE;
+  virtual void RenderViewGone() OVERRIDE;
 
   InstantClient client_;
   InstantController* const controller_;