race condition when taking a page out of bfcache and putting it back in again

[Fergal Daly]

After a lot of poking, I managed to boil this bug down to (on a chromeos build)

with a large bfcache (unclear if necessary, maybe if a.com and c.com were not cacheable this would repro with cache_size=1, I haven't tried that)

navigate: a.com-> b.com -> c.com
Back (to b.com)
Back (to a.com)
Wait 2s
Let the runloop run

You get an unexpected message blink.mojom.LocalFrameHost DidFocusFrame.

According to UMA we are seeing about 1bn unexpected LocalFrameHost messages per week! Unclear if it's these are the same thing but it seems likely given how easy it is to repro

https://uma.googleplex.com/p/chrome/histograms?sid=da9c46e5400aca35f9373f768d65bd51

A billion of anything seems like a lot! Although looking at the code, it seems like we allow the message through anyway, so hopefully if anything bad is happening, we're evicting.

It's unclear to me if this is anything more than a problem in testing,

I haven't looked at the trace yet but if anyone knows off the top of their head why this is going wrong, let me know,

F