OOPIF: Remove the FrameTreeNode when a RemoteFrame is detached.

content/browser/frame_host/render_frame_proxy_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 
 #include "base/lazy_instance.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
@@ skipping 98 matching lines @@
   return GetProcess()->Send(msg);
 }
 
 bool RenderFrameProxyHost::OnMessageReceived(const IPC::Message& msg) {
   if (cross_process_frame_connector_.get() &&
       cross_process_frame_connector_->OnMessageReceived(msg))
     return true;
 
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(RenderFrameProxyHost, msg)
+    IPC_MESSAGE_HANDLER(FrameHostMsg_Detach, OnDetach)
     IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
 bool RenderFrameProxyHost::InitRenderFrameProxy() {
   DCHECK(!render_frame_proxy_created_);
   // The process may (if we're sharing a process with another host that already
   // initialized it) or may not (we have our own process or the old process
@@ skipping 21 matching lines @@
                                       ->current_replication_state()));
 
   render_frame_proxy_created_ = true;
   return true;
 }
 
 void RenderFrameProxyHost::DisownOpener() {
   Send(new FrameMsg_DisownOpener(GetRoutingID()));
 }
 
+void RenderFrameProxyHost::OnDetach() {
+  // This message should only be received for subframes, and only from processes
+  // of its ancestor frames (which have the ability to remove it).
+  if (frame_tree_node_->IsMainFrame() ||
+      !frame_tree_node_->HasAncestorFrom(GetSiteInstance())) {
+    // TODO(creis): Use updated contract for ReceivedBadMessage.
+    GetProcess()->ReceivedBadMessage();
+    return;
+  }
+  frame_tree_node_->frame_tree()->RemoveFrame(frame_tree_node_);
+}
+
 void RenderFrameProxyHost::OnOpenURL(
     const FrameHostMsg_OpenURL_Params& params) {
+  // TODO(creis): Verify that we are in the same BrowsingInstance as the current
+  // RenderFrameHost.  See NavigatorImpl::RequestOpenURL.
   frame_tree_node_->current_frame_host()->OpenURL(params, site_instance_.get());
 }
 
 }  // namespace content