When a proxy is detached, immediately delete its associated provisional frame.

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <stdint.h>
 #include <map>
 #include <utility>
 
@@ skipping 56 matching lines @@
 
 }  // namespace
 
 // static
 RenderFrameProxy* RenderFrameProxy::CreateProxyToReplaceFrame(
     RenderFrameImpl* frame_to_replace,
     int routing_id,
     blink::WebTreeScopeType scope) {
   CHECK_NE(routing_id, MSG_ROUTING_NONE);
 
-  std::unique_ptr<RenderFrameProxy> proxy(
-      new RenderFrameProxy(routing_id, frame_to_replace->GetRoutingID()));
+  std::unique_ptr<RenderFrameProxy> proxy(new RenderFrameProxy(routing_id));
 
   // When a RenderFrame is replaced by a RenderProxy, the WebRemoteFrame should
   // always come from WebRemoteFrame::create and a call to WebFrame::swap must
   // follow later.
   blink::WebRemoteFrame* web_frame =
       blink::WebRemoteFrame::create(scope, proxy.get());
 
   // If frame_to_replace has a RenderFrameProxy parent, then its
   // RenderWidget will be destroyed along with it, so the new
   // RenderFrameProxy uses its parent's RenderWidget.
@@ skipping 17 matching lines @@
   RenderFrameProxy* parent = nullptr;
   if (parent_routing_id != MSG_ROUTING_NONE) {
     parent = RenderFrameProxy::FromRoutingID(parent_routing_id);
     // It is possible that the parent proxy has been detached in this renderer
     // process, just as the parent's real frame was creating this child frame.
     // In this case, do not create the proxy. See https://crbug.com/568670.
     if (!parent)
       return nullptr;
   }
 
-  std::unique_ptr<RenderFrameProxy> proxy(
-      new RenderFrameProxy(routing_id, MSG_ROUTING_NONE));
+  std::unique_ptr<RenderFrameProxy> proxy(new RenderFrameProxy(routing_id));
   RenderViewImpl* render_view = nullptr;
   RenderWidget* render_widget = nullptr;
   blink::WebRemoteFrame* web_frame = nullptr;
 
   if (!parent) {
     // Create a top level WebRemoteFrame.
     render_view = RenderViewImpl::FromRoutingID(render_view_routing_id);
     web_frame = blink::WebRemoteFrame::create(replicated_state.scope,
                                               proxy.get(), opener);
     render_view->webview()->setMainFrame(web_frame);
@@ skipping 45 matching lines @@
 RenderFrameProxy* RenderFrameProxy::FromWebFrame(blink::WebFrame* web_frame) {
   FrameMap::iterator iter = g_frame_map.Get().find(web_frame);
   if (iter != g_frame_map.Get().end()) {
     RenderFrameProxy* proxy = iter->second;
     DCHECK_EQ(web_frame, proxy->web_frame());
     return proxy;
   }
   return NULL;
 }
 
-RenderFrameProxy::RenderFrameProxy(int routing_id, int frame_routing_id)
+RenderFrameProxy::RenderFrameProxy(int routing_id)
     : routing_id_(routing_id),
-      frame_routing_id_(frame_routing_id),
+      provisional_frame_routing_id_(MSG_ROUTING_NONE),
       web_frame_(nullptr),
       render_view_(nullptr),
       render_widget_(nullptr) {
   std::pair<RoutingIDProxyMap::iterator, bool> result =
       g_routing_id_proxy_map.Get().insert(std::make_pair(routing_id_, this));
   CHECK(result.second) << "Inserting a duplicate item.";
   RenderThread::Get()->AddRoute(routing_id_, this);
 }
 
 RenderFrameProxy::~RenderFrameProxy() {
@@ skipping 217 matching lines @@
   if (type == DetachType::Remove && web_frame_->parent()) {
     web_frame_->parent()->removeChild(web_frame_);
 
     // Let the browser process know this subframe is removed, so that it is
     // destroyed in its current process.
     Send(new FrameHostMsg_Detach(routing_id_));
   }
 
   web_frame_->close();
 
+  // If this proxy was associated with a provisional RenderFrame, and we're not
+  // in the process of swapping with it, clean it up as well.
+  if (type == DetachType::Remove &&
+      provisional_frame_routing_id_ != MSG_ROUTING_NONE) {
+    RenderFrameImpl* provisional_frame =
+        RenderFrameImpl::FromRoutingID(provisional_frame_routing_id_);
+    // |provisional_frame| should always exist.  If it was deleted via
+    // FrameMsg_Delete right before this proxy was removed,
+    // RenderFrameImpl::frameDetached would've cleared this proxy's
+    // |provisional_frame_routing_id_| and we wouldn't get here.
+    CHECK(provisional_frame);
+    provisional_frame->GetWebFrame()->detach();
+  }
+
   // Remove the entry in the WebFrame->RenderFrameProxy map, as the |web_frame_|
   // is no longer valid.
   FrameMap::iterator it = g_frame_map.Get().find(web_frame_);
   CHECK(it != g_frame_map.Get().end());
   CHECK_EQ(it->second, this);
   g_frame_map.Get().erase(it);
 
   web_frame_ = nullptr;
 
   delete this;
@@ skipping 94 matching lines @@
                                     blink::WebLocalFrame* source) {
   int source_routing_id = RenderFrameImpl::FromWebFrame(source)->GetRoutingID();
   Send(new FrameHostMsg_AdvanceFocus(routing_id_, type, source_routing_id));
 }
 
 void RenderFrameProxy::frameFocused() {
   Send(new FrameHostMsg_FrameFocused(routing_id_));
 }
 
 }  // namespace