Fix leaking of RenderFrames.

content/renderer/render_frame_impl.h

Index: content/renderer/render_frame_impl.h
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index ab7821459ba05130ea65f753329bbb85ac17b198..f743bbf3b6a689d7bd4b250ad21e4279f8490e79 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -707,6 +707,7 @@ class CONTENT_EXPORT RenderFrameImpl
   void OnSwapOut(int proxy_routing_id,
                  bool is_loading,
                  const FrameReplicationState& replicated_frame_state);
+  void OnDeleteFrame();
   void OnStop();
   void OnShowContextMenu(const gfx::Point& location);
   void OnContextMenuClosed(const CustomContextMenuContext& custom_context);
@@ -945,6 +946,24 @@ class CONTENT_EXPORT RenderFrameImpl
   // |frame_| has been invalidated.
   bool is_main_frame_;
 
+  // When a frame is detached in response to a message from the browser process,
+  // this RenderFrame should not be sending notifications back to it. This
+  // boolean is used to indicate this case.
+  bool in_browser_initiated_detach_;
+
+  // Indicates whether the frame has been inserted into the frame tree yet or
+  // not.
+  //
+  // When a frame is created by the browser process, it is for a pending
+  // navigation. In this case, it is not immediately attached to the frame tree
+  // if there is a RenderFrameProxy for the same frame. It is inserted into the
+  // frame tree at the time the pending navigation commits.
+  // Frames added by the parent document are created from the renderer process
+  // and are immediately inserted in the frame tree.
+  // TODO(dcheng): Remove this once we have FrameTreeHandle and can use the
+  // Blink Web* layer to check for provisional frames.
+  bool in_frame_tree_;
+
   base::WeakPtr<RenderViewImpl> render_view_;
   int routing_id_;
   bool is_swapped_out_;