Allow IPCs during RenderFrameObserver::FrameDetached()

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 437e8c98be937398ffd4b3ca46cdfb4c5b964f16..aed52c0bf82d40c895af739605c6d24d8eaea474 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -2080,18 +2080,16 @@ void RenderFrameImpl::frameDetached(blink::WebFrame* frame) {
 
   bool is_subframe = !!frame->parent();
 
+  FOR_EACH_OBSERVER(RenderFrameObserver, observers_, FrameDetached());
+  FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
+                    FrameDetached(frame));
+
   Send(new FrameHostMsg_Detach(routing_id_));
 
   // The |is_detaching_| flag disables Send(). FrameHostMsg_Detach must be
-  // sent before setting |is_detaching_| to true. In contrast, Observers
-  // should only be notified afterwards so they cannot call back into here and
-  // have IPCs fired off.
+  // sent before setting |is_detaching_| to true.
   is_detaching_ = true;
 
-  FOR_EACH_OBSERVER(RenderFrameObserver, observers_, FrameDetached());
-  FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
-                    FrameDetached(frame));
-
   // We need to clean up subframes by removing them from the map and deleting
   // the RenderFrameImpl.  In contrast, the main frame is owned by its
   // containing RenderViewHost (so that they have the same lifetime), so only