Fix leaking of RenderFrames.

content/renderer/render_frame_impl.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_RENDERER_RENDER_FRAME_IMPL_H_
 #define CONTENT_RENDERER_RENDER_FRAME_IMPL_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 158 matching lines @@
       int routing_id,
       int proxy_routing_id,
       int opener_routing_id,
       int parent_routing_id,
       int previous_sibling_routing_id,
       const FrameReplicationState& replicated_state,
       CompositorDependencies* compositor_deps,
       const FrameMsg_NewFrame_WidgetParams& params,
       const blink::WebFrameOwnerProperties& frameOwner_properties);
 
+  // Detaches a RenderFrame identified by |routing_id|.
+  static void DetachFrame(int routing_id);
+
   // Returns the RenderFrameImpl for the given routing ID.
   static RenderFrameImpl* FromRoutingID(int routing_id);
 
   // Just like RenderFrame::FromWebFrame but returns the implementation.
   static RenderFrameImpl* FromWebFrame(blink::WebFrame* web_frame);
 
   // Used by content_layouttest_support to hook into the creation of
   // RenderFrameImpls.
   struct CreateParams {
     CreateParams(RenderViewImpl* render_view, int32 routing_id)
@@ skipping 728 matching lines @@
   void RegisterMojoServices();
 
   // Connects to a Mojo application and returns a proxy to its exposed
   // ServiceProvider.
   mojo::ServiceProviderPtr ConnectToApplication(const GURL& url);
 
   // Returns the media delegate for WebMediaPlayer usage.  If
   // |media_player_delegate_| is NULL, one is created.
   media::RendererWebMediaPlayerDelegate* GetWebMediaPlayerDelegate();
 
+  void set_in_browser_initiated_detach() {
+    in_browser_initiated_detach_ = true;
+  }
+
   // Stores the WebLocalFrame we are associated with.  This is null from the
   // constructor until SetWebFrame is called, and it is null after
   // frameDetached is called until destruction (which is asynchronous in the
   // case of the main frame, but not subframes).
   blink::WebLocalFrame* frame_;
 
   // Boolean value indicating whether this RenderFrameImpl object is for the
   // main frame or not. It remains accurate during destruction, even when
   // |frame_| has been invalidated.
   bool is_main_frame_;
 
+  // Frame is a local root if it is rendered in a process different than parent
+  // or it is a main frame.
+  bool is_local_root_;
+
+  // When a frame is detached in response to a message from the browser process,
+  // this RenderFrame should not be sending notifications back to it. This
+  // boolean is used to indicate this case.
+  bool in_browser_initiated_detach_;
+
+  // Indicates which of the two states this frame is currently in.
+  //
+  // When a frame is created by the browser process, it is for a pending
+  // navigation. In this case, it is not immediately attached to the frame tree
+  // and is inserted into it at the time the pending navigation commits.
+  // Frames added by the parent document are created from the renderer process
+  // and are immediately inserted in the frame tree.
+  bool in_frame_tree_;

[dcheng, 2015/12/11 23:40:17]

You can TODO(dcheng) to clean this up: FrameTreeHandle will make it trivial to
detect provisional frames in the web layer, and I'll likely expose it since
having to store this is silly (but necessary at the moment).

[nasko, 2015/12/14 21:00:02]

Done.

+
   base::WeakPtr<RenderViewImpl> render_view_;
   int routing_id_;
   bool is_swapped_out_;
 
   // RenderFrameProxy exists only when is_swapped_out_ is true.
   // TODO(nasko): This can be removed once we don't have a swapped out state on
   // RenderFrame. See https://crbug.com/357747.
   RenderFrameProxy* render_frame_proxy_;
   bool is_detaching_;
 
@@ skipping 181 matching lines @@
 #endif
 
   base::WeakPtrFactory<RenderFrameImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_RENDERER_RENDER_FRAME_IMPL_H_