When a proxy is detached, immediately delete its associated provisional frame.

content/browser/site_per_process_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/site_per_process_browsertest.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 6201 matching lines @@
   observer.Wait();
   EXPECT_EQ(1U, root->child_count());
 
   // Make sure the a.com renderer does not crash.
   int child_count = 0;
   EXPECT_TRUE(ExecuteScriptAndExtractInt(
       root, "domAutomationController.send(frames.length)", &child_count));
   EXPECT_EQ(1, child_count);
 }
 
-#if defined(OS_LINUX)
-#define MAYBE_NavigateAboutBlankAndDetach DISABLED_NavigateAboutBlankAndDetach
-#else
-#define MAYBE_NavigateAboutBlankAndDetach NavigateAboutBlankAndDetach
-#endif
 // Similar to NavigateProxyAndDetachBeforeCommit, but uses a synchronous
 // navigation to about:blank and the parent removes the child frame in a load
 // event handler for the subframe.
-IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
-                       MAYBE_NavigateAboutBlankAndDetach) {
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigateAboutBlankAndDetach) {

[alexmos, 2017/01/13 02:26:54]

This test was disabled in https://crbug.com/660622, but it's passing for me
locally, so I don't know if something fixed it since then.  I'd like to try and
re-enable it here since it also tackles the same case of removing the proxy in a
remote-to-local navigation.  I made it a little more robust by waiting for the
subframe to be deleted, rather than for its navigation to succeed, which might
have caused some raciness (not sure).  We can take another look at it if it
starts failing again.

[Charlie Reis, 2017/01/18 00:18:41]

Acknowledged.

   GURL main_url(
       embedded_test_server()->GetURL("a.com", "/remove_frame_on_load.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   WebContents* contents = shell()->web_contents();
   FrameTreeNode* root =
       static_cast<WebContentsImpl*>(contents)->GetFrameTree()->root();
   EXPECT_EQ(1U, root->child_count());
   FrameTreeNode* child = root->child_at(0);
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             child->current_frame_host()->GetSiteInstance());
 
-  // Navigate the child frame to "about:blank" from the parent document.
-  TestNavigationObserver observer(shell()->web_contents());
+  // Navigate the child frame to "about:blank" from the parent document and
+  // wait for it to be removed.
+  FrameDeletedObserver observer(child);
   EXPECT_TRUE(ExecuteScript(
       root, base::StringPrintf("f.src = '%s'", url::kAboutBlankURL)));
   observer.Wait();
 
   // Make sure the a.com renderer does not crash and the frame is removed.
   int child_count = 0;
   EXPECT_TRUE(ExecuteScriptAndExtractInt(
       root, "domAutomationController.send(frames.length)", &child_count));
   EXPECT_EQ(0, child_count);
 }
@@ skipping 2784 matching lines @@
 
   std::string result;
   EXPECT_TRUE(ExecuteScriptAndExtractString(
       root,
       "window.domAutomationController.send(frames[0].document.body.innerText);",
       &result));
   EXPECT_EQ("This page has no title.", result);
 }
 
 }  // namespace content