Detach old frame on WebFrame::swap.

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <map>
 
 #include "base/lazy_instance.h"
 #include "content/child/webmessageportchannel_impl.h"
 #include "content/common/frame_messages.h"
 #include "content/common/frame_replication_state.h"
 #include "content/common/swapped_out_messages.h"
 #include "content/common/view_messages.h"
 #include "content/renderer/child_frame_compositing_helper.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "third_party/WebKit/public/platform/WebString.h"
+#include "third_party/WebKit/public/web/WebFrameClient.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
 #include "third_party/WebKit/public/web/WebView.h"
 
 namespace content {
 
 namespace {
 
 // Facilitates lookup of RenderFrameProxy by routing_id.
 typedef std::map<int, RenderFrameProxy*> RoutingIDProxyMap;
@@ skipping 273 matching lines @@
 void RenderFrameProxy::OnDidUpdateName(const std::string& name) {
   web_frame_->setReplicatedName(blink::WebString::fromUTF8(name));
 }
 
 void RenderFrameProxy::OnDidUpdateOrigin(const url::Origin& origin) {
   web_frame_->setReplicatedOrigin(blink::WebSecurityOrigin::createFromString(
       blink::WebString::fromUTF8(origin.string())));
 }
 
 void RenderFrameProxy::frameDetached() {
-  if (web_frame_->parent()) {
+  frameDetached(blink::WebDetachReason::Remove);
+}
+
+void RenderFrameProxy::frameDetached(blink::WebDetachReason reason) {
+  if (reason == blink::WebDetachReason::Remove && web_frame_->parent()) {
     web_frame_->parent()->removeChild(web_frame_);
 
     // Let the browser process know this subframe is removed, so that it is
     // destroyed in its current process.
     Send(new FrameHostMsg_Detach(routing_id_));
   }
 
   web_frame_->close();
 
   // Remove the entry in the WebFrame->RenderFrameProxy map, as the |web_frame_|
@@ skipping 60 matching lines @@
       blink::WebUserGestureIndicator::isProcessingUserGesture();
   blink::WebUserGestureIndicator::consumeUserGesture();
   Send(new FrameHostMsg_OpenURL(routing_id_, params));
 }
 
 void RenderFrameProxy::forwardInputEvent(const blink::WebInputEvent* event) {
   Send(new FrameHostMsg_ForwardInputEvent(routing_id_, event));
 }
 
 }  // namespace