OOPIF: Remove the FrameTreeNode when a RemoteFrame is detached.

content/browser/frame_host/render_frame_proxy_host.cc

Index: content/browser/frame_host/render_frame_proxy_host.cc
diff --git a/content/browser/frame_host/render_frame_proxy_host.cc b/content/browser/frame_host/render_frame_proxy_host.cc
index 988f9e876b4bdc989331f534aed27ff9014d36f5..8d10da592e453ac4f797ebf6a7831e04500b001b 100644
--- a/content/browser/frame_host/render_frame_proxy_host.cc
+++ b/content/browser/frame_host/render_frame_proxy_host.cc
@@ -116,6 +116,7 @@ bool RenderFrameProxyHost::OnMessageReceived(const IPC::Message& msg) {
 
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(RenderFrameProxyHost, msg)
+    IPC_MESSAGE_HANDLER(FrameHostMsg_Detach, OnDetach)
     IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
@@ -157,6 +158,10 @@ void RenderFrameProxyHost::DisownOpener() {
   Send(new FrameMsg_DisownOpener(GetRoutingID()));
 }
 
+void RenderFrameProxyHost::OnDetach() {

[ncarter (slow), 2015/03/27 22:03:46]

Do we need to apply some filtering here?

Seems like we'd only want to allow detach operations to originate from the
process that owns the frame. So this would be a check on the site instance of
the parent, I think.

[Charlie Reis, 2015/03/28 00:09:18]

This is an excellent point.  Unfortunately, it's a bit more complex than that. 
We need to check whether it's from the process of any of the frame's ancestors,
since Blink will recursively detach all the subframes of a frame that it removes
(even when they're RemoteFrames).

I wonder if this is changing with @lfg's work.

+  frame_tree_node_->frame_tree()->RemoveFrame(frame_tree_node_);
+}
+
 void RenderFrameProxyHost::OnOpenURL(
     const FrameHostMsg_OpenURL_Params& params) {
   frame_tree_node_->current_frame_host()->OpenURL(params, site_instance_.get());