Fix leaking of RenderFrames.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 905 matching lines @@
       // document. Check if |render_frame_host| is already swapped out, to avoid
       // swapping it out again.
       if (!render_frame_host->is_swapped_out())
         render_frame_host->SwapOut(proxy, false);
 
       proxy->TakeFrameHostOwnership(render_frame_host.Pass());
     }
   }
 
   if (render_frame_host) {
+    if (!frame_tree_node_->IsMainFrame() &&
+        SiteIsolationPolicy::IsSwappedOutStateForbidden()) {
+      // Clean up the unused RenderFrame in the renderer process for any
+      // subframe. The main frame is going to be cleaned up by RenderViewHost
+      // deleting RenderView.
+      render_frame_host->Send(
+          new FrameMsg_Detach(render_frame_host->GetRoutingID()));
+    }
+
     // We won't be coming back, so delete this one.
     ShutdownProxiesIfLastActiveFrameInSiteInstance(render_frame_host.get());
     render_frame_host.reset();
   }
 }
 
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
   // If this is the main frame going away and there are no more references to
   // its RenderViewHost, mark it for deletion as well so that we don't try to
@@ skipping 1746 matching lines @@
 int RenderFrameHostManager::GetOpenerRoutingID(SiteInstance* instance) {
   if (!frame_tree_node_->opener())
     return MSG_ROUTING_NONE;
 
   return frame_tree_node_->opener()
       ->render_manager()
       ->GetRoutingIdForSiteInstance(instance);
 }
 
 }  // namespace content