Fix leaking of RenderFrames.

content/renderer/render_frame_impl.h

Index: content/renderer/render_frame_impl.h
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index ab61ca67f8bb8775bf231080635cb7bbcb61b0ea..62ce396f56aad349f37925069d6c23ba7bb761c2 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -169,6 +169,9 @@ class CONTENT_EXPORT RenderFrameImpl
                           CompositorDependencies* compositor_deps,
                           const FrameMsg_NewFrame_WidgetParams& params);
 
+  // Detaches a RenderFrame identified by |routing_id|.
+  static void DetachFrame(int routing_id);
+
   // Returns the RenderFrameImpl for the given routing ID.
   static RenderFrameImpl* FromRoutingID(int routing_id);
 
@@ -886,6 +889,10 @@ class CONTENT_EXPORT RenderFrameImpl
   // ServiceProvider.
   mojo::ServiceProviderPtr ConnectToApplication(const GURL& url);
 
+  void set_in_browser_initiated_detach() {
+    in_browser_initiated_detach_ = true;
+  }
+
   // Stores the WebLocalFrame we are associated with.  This is null from the
   // constructor until SetWebFrame is called, and it is null after
   // frameDetached is called until destruction (which is asynchronous in the
@@ -901,6 +908,19 @@ class CONTENT_EXPORT RenderFrameImpl
   // or it is a main frame.
   bool is_local_root_;
 
+  // When a frame is detached in response to a messge from the browser process,
+  // this RenderFrame should not be sending notifications back to it. This
+  // boolean is used to indicate this case.
+  bool in_browser_initiated_detach_;
+
+  // When a frame is created by the browser process, it is for a pending
+  // navigation. In this case, it is not immediately attached to the frame tree
+  // and is inserted into it at the time the pending navigation commits.
+  // Frames added by the parent document are created from the renderer process
+  // and are immediately inserted in the frame tree. This boolean indicates
+  // which of the two states this frame is currently in.

[Charlie Reis, 2015/11/04 21:28:30]

Let's move the last sentence to be the first one and rephrase to:
// Indicates whether the frame has been inserted into the frame tree yet or not.
//
// When a frame...

[nasko, 2015/12/10 21:26:52]

Done.

+  bool is_inserted_in_frame_tree_;

[Charlie Reis, 2015/11/04 21:28:30]

nit: in_frame_tree_

[nasko, 2015/12/10 21:26:52]

Done.

+
   base::WeakPtr<RenderViewImpl> render_view_;
   int routing_id_;
   bool is_swapped_out_;