Fix leaking of RenderFrames.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 623fd1679c52b25ea070f4fb974b3ecbe4f00856..fe282ce67dab84cb8b130da3ecbc0c5c0c677929 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -670,6 +670,17 @@ void RenderFrameImpl::CreateFrame(
 }
 
 // static
+void RenderFrameImpl::DetachFrame(int routing_id) {
+  RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(routing_id);
+  // TODO(nasko): Investigate why it is possible to receive a FrameMsg_Detach
+  // for a frame that is no longer alive.
+  if (frame) {
+    frame->set_is_browser_initiated_detach();
+    frame->GetWebFrame()->detach();
+  }
+}
+
+// static
 RenderFrame* RenderFrame::FromWebFrame(blink::WebFrame* web_frame) {
   return RenderFrameImpl::FromWebFrame(web_frame);
 }
@@ -732,6 +743,7 @@ RenderFrameImpl::RenderFrameImpl(const CreateParams& params)
     : frame_(NULL),
       is_main_frame_(true),
       is_local_root_(false),
+      is_browser_initiated_detach_(false),
       render_view_(params.render_view->AsWeakPtr()),
       routing_id_(params.routing_id),
       is_swapped_out_(false),
@@ -2360,9 +2372,10 @@ void RenderFrameImpl::frameDetached(blink::WebFrame* frame, DetachType type) {
                     FrameDetached(frame));
 
   // We only notify the browser process when the frame is being detached for
-  // removal. If the frame is being detached for swap, we don't need to do this
-  // since we are not modifiying the frame tree.
-  if (type == DetachType::Remove)
+  // removal. If the frame is being detached for swap or the frame isn't fully
+  // initialized, we don't need to do this since we are not modifiying the frame
+  // tree.
+  if (!is_browser_initiated_detach_ && type == DetachType::Remove)
     Send(new FrameHostMsg_Detach(routing_id_));
 
   // The |is_detaching_| flag disables Send(). FrameHostMsg_Detach must be
@@ -2387,7 +2400,10 @@ void RenderFrameImpl::frameDetached(blink::WebFrame* frame, DetachType type) {
   // Only remove the frame from the renderer's frame tree if the frame is
   // being detached for removal. In the case of a swap, the frame needs to
   // remain in the tree so WebFrame::swap() can replace it with the new frame.
-  if (!is_main_frame_ && type == DetachType::Remove)
+  // If the frame isn't fully initialized (e.g. deleting a pending RenderFrame)
+  // it is not linked into the frame tree, so it should not be removed.
+  if (!is_browser_initiated_detach_ && !is_main_frame_ &&
+      type == DetachType::Remove)
     frame->parent()->removeChild(frame);
 
   // |frame| is invalid after here.  Be sure to clear frame_ as well, since this