Fix leaking of RenderFrames.

content/renderer/render_frame_impl.h

Index: content/renderer/render_frame_impl.h
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 9da61e04250a2d27d3ab7f82375f92a834f10b39..48bd6fd1d136359c58b198ebc002ab607fb9938d 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -176,6 +176,9 @@ class CONTENT_EXPORT RenderFrameImpl
       const FrameMsg_NewFrame_WidgetParams& params,
       const blink::WebFrameOwnerProperties& frameOwner_properties);
 
+  // Detaches a RenderFrame identified by |routing_id|.
+  static void DetachFrame(int routing_id);

[Charlie Reis, 2015/12/11 00:03:17]

Sanity check: Does calling this Detach really make sense?  We're calling it in
cases that the frame hasn't been attached to the tree yet.  I wonder if it would
be clearer to say something like DestroyFrame.

(It seems like we should be verifying that this is only called for pending
RenderFrames.  See my other comment/concern about that in the .cc file.)

[nasko, 2015/12/11 00:47:25]

I am calling it now in all cases, regardless of whether it is in the tree or
not. I called it Detach, as it matches the semantics of Blink, though Destroy
can also work as it is more universal.
Not anymore.

+
   // Returns the RenderFrameImpl for the given routing ID.
   static RenderFrameImpl* FromRoutingID(int routing_id);
 
@@ -924,6 +927,10 @@ class CONTENT_EXPORT RenderFrameImpl
   // |media_player_delegate_| is NULL, one is created.
   media::RendererWebMediaPlayerDelegate* GetWebMediaPlayerDelegate();
 
+  void set_in_browser_initiated_detach() {
+    in_browser_initiated_detach_ = true;
+  }
+
   // Stores the WebLocalFrame we are associated with.  This is null from the
   // constructor until SetWebFrame is called, and it is null after
   // frameDetached is called until destruction (which is asynchronous in the
@@ -935,6 +942,25 @@ class CONTENT_EXPORT RenderFrameImpl
   // |frame_| has been invalidated.
   bool is_main_frame_;
 
+  // Frame is a local root if it is rendered in a process different than parent
+  // or it is a main frame.
+  bool is_local_root_;
+
+  // When a frame is detached in response to a messge from the browser process,

[Charlie Reis, 2015/12/11 00:03:17]

nit: message

[nasko, 2015/12/11 00:47:25]

Done.

+  // this RenderFrame should not be sending notifications back to it. This
+  // boolean is used to indicate this case.
+  bool in_browser_initiated_detach_;
+
+

[Charlie Reis, 2015/12/11 00:03:17]

nit: Remove extra blank line.

[nasko, 2015/12/11 00:47:25]

Done.

+  // Indicates which of the two states this frame is currently in.
+  //
+  // When a frame is created by the browser process, it is for a pending
+  // navigation. In this case, it is not immediately attached to the frame tree
+  // and is inserted into it at the time the pending navigation commits.
+  // Frames added by the parent document are created from the renderer process
+  // and are immediately inserted in the frame tree.
+  bool in_frame_tree_;
+
   base::WeakPtr<RenderViewImpl> render_view_;
   int routing_id_;
   bool is_swapped_out_;