Fix leaking of RenderFrames.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 899 matching lines @@
       // document. Check if |render_frame_host| is already swapped out, to avoid
       // swapping it out again.
       if (!render_frame_host->is_swapped_out())
         render_frame_host->SwapOut(proxy, false);
 
       proxy->TakeFrameHostOwnership(render_frame_host.Pass());
     }
   }
 
   if (render_frame_host) {
+    if (SiteIsolationPolicy::IsSwappedOutStateForbidden()) {
+      // RenderFrame that has not committed yet isn't linked into the renderer

[Charlie Reis, 2015/10/29 17:28:58]

nit: Let's rephrase this.  Is the part about being linked into the renderer's
frame tree relevant here?  Seems like we would need to tell the renderer process
to delete it either way.

Maybe something as simple as this?
Also clean up the unused RenderFrame in the renderer process.

[nasko, 2015/10/29 19:09:45]

Done.

+      // process frame tree. This requires an explicit cleanup, so send an IPC
+      // to delete the RenderFrame.
+      render_frame_host->Send(
+          new FrameMsg_DeleteFrame(render_frame_host->GetRoutingID()));
+    }
+
     // We won't be coming back, so delete this one.
     ShutdownProxiesIfLastActiveFrameInSiteInstance(render_frame_host.get());
     render_frame_host.reset();
   }
 }
 
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
   // If this is the main frame going away and there are no more references to
   // its RenderViewHost, mark it for deletion as well so that we don't try to
@@ skipping 1739 matching lines @@
 int RenderFrameHostManager::GetOpenerRoutingID(SiteInstance* instance) {
   if (!frame_tree_node_->opener())
     return MSG_ROUTING_NONE;
 
   return frame_tree_node_->opener()
       ->render_manager()
       ->GetRoutingIdForSiteInstance(instance);
 }
 
 }  // namespace content