Detach old frame on WebFrame::swap.

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <map>
 
 #include "base/lazy_instance.h"
 #include "content/child/webmessageportchannel_impl.h"
@@ skipping 292 matching lines @@
 void RenderFrameProxy::OnDidUpdateName(const std::string& name) {
   web_frame_->setReplicatedName(blink::WebString::fromUTF8(name));
 }
 
 void RenderFrameProxy::OnDidUpdateOrigin(const url::Origin& origin) {
   web_frame_->setReplicatedOrigin(blink::WebSecurityOrigin::createFromString(
       blink::WebString::fromUTF8(origin.string())));
 }
 
 void RenderFrameProxy::frameDetached() {
-  if (web_frame_->parent()) {
+  frameDetached(false);
+}
+
+void RenderFrameProxy::frameDetached(bool for_replacement) {
+  if (!for_replacement && web_frame_->parent()) {
     web_frame_->parent()->removeChild(web_frame_);
 
     // Let the browser process know this subframe is removed, so that it is
     // destroyed in its current process.
     Send(new FrameHostMsg_Detach(routing_id_));
   }
 
   web_frame_->close();
 
   // Remove the entry in the WebFrame->RenderFrameProxy map, as the |web_frame_|
@@ skipping 60 matching lines @@
       blink::WebUserGestureIndicator::isProcessingUserGesture();
   blink::WebUserGestureIndicator::consumeUserGesture();
   Send(new FrameHostMsg_OpenURL(routing_id_, params));
 }
 
 void RenderFrameProxy::forwardInputEvent(const blink::WebInputEvent* event) {
   Send(new FrameHostMsg_ForwardInputEvent(routing_id_, event));
 }
 
 }  // namespace