When a proxy is detached, immediately delete its associated provisional frame.

content/renderer/render_frame_proxy.h

Index: content/renderer/render_frame_proxy.h
diff --git a/content/renderer/render_frame_proxy.h b/content/renderer/render_frame_proxy.h
index e7f2e54377778a5168b6494f00e08e8c84972b70..d435727c822eab50ef8788e877f0e23fe356816f 100644
--- a/content/renderer/render_frame_proxy.h
+++ b/content/renderer/render_frame_proxy.h
@@ -118,6 +118,12 @@ class CONTENT_EXPORT RenderFrameProxy
   RenderViewImpl* render_view() { return render_view_; }
   blink::WebRemoteFrame* web_frame() { return web_frame_; }
 
+  void set_provisional_frame_routing_id(int routing_id) {
+    provisional_frame_routing_id_ = routing_id;
+  }
+
+  int provisional_frame_routing_id() { return provisional_frame_routing_id_; }
+
   // Returns the widget used for the local frame root.
   RenderWidget* render_widget() { return render_widget_; }
 
@@ -142,7 +148,7 @@ class CONTENT_EXPORT RenderFrameProxy
   void OnDidStartLoading();
 
  private:
-  RenderFrameProxy(int routing_id, int frame_routing_id);
+  RenderFrameProxy(int routing_id);
 
   void Init(blink::WebRemoteFrame* frame,
             RenderViewImpl* render_view,
@@ -177,9 +183,9 @@ class CONTENT_EXPORT RenderFrameProxy
   // The routing ID by which this RenderFrameProxy is known.
   const int routing_id_;
 
-  // The routing ID of the local RenderFrame (if any) which this
-  // RenderFrameProxy is meant to replace in the frame tree.
-  const int frame_routing_id_;
+  // The routing ID of the provisional RenderFrame (if any) that is meant to
+  // replace this RenderFrameProxy in the frame tree.
+  int provisional_frame_routing_id_;

[alexmos, 2017/01/13 02:26:54]

frame_routing_id_ was unused, so I just took it out in favor of
provisional_frame_routing_id_.

[Charlie Reis, 2017/01/18 00:18:42]

Acknowledged.

 
   // Stores the WebRemoteFrame we are associated with.
   blink::WebRemoteFrame* web_frame_;