Fix leaking of RenderFrames.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 905 matching lines @@
       // document. Check if |render_frame_host| is already swapped out, to avoid
       // swapping it out again.
       if (!render_frame_host->is_swapped_out())
         render_frame_host->SwapOut(proxy, false);
 
       proxy->TakeFrameHostOwnership(render_frame_host.Pass());
     }
   }
 
   if (render_frame_host) {
+    // Clean up the unused RenderFrame in the renderer process for any
+    // subframe. The main frame is going to be cleaned up by RenderViewHost
+    // deleting RenderView, unless there are other active frames.
+    if (SiteIsolationPolicy::IsSwappedOutStateForbidden() &&
+        (render_frame_host->GetSiteInstance()->active_frame_count() > 1U ||

[Charlie Reis, 2015/11/04 21:28:30]

Did you have a concern about this?  I'm looking at it and it seems ok to me. 
Can you remind me which method of RFHM does the cleanup if active_frame_count()
is only 1?  As long as the conditions match, I think we should be good.

[nasko, 2015/12/10 21:26:52]

It is coincidentally right after this -
ShutdownProxiesIfLastActiveFrameInSiteInstance.

+         !frame_tree_node_->IsMainFrame())) {
+      render_frame_host->Send(
+          new FrameMsg_Detach(render_frame_host->GetRoutingID()));
+    }
+
     // We won't be coming back, so delete this one.
     ShutdownProxiesIfLastActiveFrameInSiteInstance(render_frame_host.get());
     render_frame_host.reset();
   }
 }
 
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
   // If this is the main frame going away and there are no more references to
   // its RenderViewHost, mark it for deletion as well so that we don't try to
@@ skipping 1746 matching lines @@
 int RenderFrameHostManager::GetOpenerRoutingID(SiteInstance* instance) {
   if (!frame_tree_node_->opener())
     return MSG_ROUTING_NONE;
 
   return frame_tree_node_->opener()
       ->render_manager()
       ->GetRoutingIdForSiteInstance(instance);
 }
 
 }  // namespace content