Do not create proxy hosts in the subtree of navigating frame.

content/browser/frame_host/frame_tree.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/frame_tree.h"
 
 #include <queue>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ skipping 47 matching lines @@
 
 // Iterate over the FrameTree to reset any node affected by the loss of the
 // given RenderViewHost's process.
 bool ResetNodesForNewProcess(RenderViewHost* render_view_host,
                              FrameTreeNode* node) {
   if (render_view_host == node->current_frame_host()->render_view_host())
     node->ResetForNewProcess();
   return true;
 }
 
-bool CreateProxyForSiteInstance(FrameTreeNode* source_node,
-                                const scoped_refptr<SiteInstance>& instance,
+bool CreateProxyForSiteInstance(const scoped_refptr<SiteInstance>& instance,
                                 FrameTreeNode* node) {
-  // Skip the node that initiated the creation.
-  if (source_node == node)
-    return true;
-
   node->render_manager()->CreateRenderFrameProxy(instance.get());
   return true;
 }
 
 }  // namespace
 
 FrameTree::FrameTree(Navigator* navigator,
                      RenderFrameHostDelegate* render_frame_delegate,
                      RenderViewHostDelegate* render_view_delegate,
                      RenderWidgetHostDelegate* render_widget_delegate,
@@ skipping 35 matching lines @@
 }
 
 FrameTreeNode* FrameTree::FindByRoutingID(int routing_id, int process_id) {
   FrameTreeNode* node = NULL;
   ForEach(
       base::Bind(&FrameTreeNodeForRoutingId, routing_id, process_id, &node));
   return node;
 }
 
 void FrameTree::ForEach(
     const base::Callback<bool(FrameTreeNode*)>& on_node) const {

[awong, 2014/09/03 21:58:38]

Reimplement this in terms of your new function?

[nasko, 2014/09/03 23:50:19]

Done.

   std::queue<FrameTreeNode*> queue;
   queue.push(root_.get());
 
   while (!queue.empty()) {
     FrameTreeNode* node = queue.front();
     queue.pop();
     if (!on_node.Run(node))
       break;
 
     for (size_t i = 0; i < node->child_count(); ++i)
       queue.push(node->child_at(i));
   }
 }
 
+void FrameTree::ForEach(
+    const base::Callback<bool(FrameTreeNode*)>& on_node,
+    FrameTreeNode* skip_node) const {
+  std::queue<FrameTreeNode*> queue;
+  queue.push(root_.get());
+
+  while (!queue.empty()) {
+    FrameTreeNode* node = queue.front();
+    queue.pop();
+    if (skip_node == node)
+      continue;
+
+    if (!on_node.Run(node))
+      break;
+
+    for (size_t i = 0; i < node->child_count(); ++i)
+      queue.push(node->child_at(i));
+  }
+}
+
 RenderFrameHostImpl* FrameTree::AddFrame(FrameTreeNode* parent,
                                          int new_routing_id,
                                          const std::string& frame_name) {
   scoped_ptr<FrameTreeNode> node(new FrameTreeNode(
       this, parent->navigator(), render_frame_delegate_, render_view_delegate_,
       render_widget_delegate_, manager_delegate_, frame_name));
   std::pair<FrameTreeNodeIDMap::iterator, bool> result =
       g_frame_tree_node_id_map.Get().insert(
           std::make_pair(node->frame_tree_node_id(), node.get()));
   CHECK(result.second);
@@ skipping 31 matching lines @@
     if (!render_view_host) {
       root()->render_manager()->CreateRenderFrame(site_instance,
                                                   MSG_ROUTING_NONE,
                                                   true,
                                                   false,
                                                   true);
     }
   }
 
   scoped_refptr<SiteInstance> instance(site_instance);
-  ForEach(base::Bind(&CreateProxyForSiteInstance, source, instance));
+
+  // When creating proxies in the FrameTree, it is in reponse to a node

[awong, 2014/09/03 21:58:38]

"Proxies are created in the FrameTree in response to a node navigating to a new
SiteInstance."

[nasko, 2014/09/03 23:50:19]

Done.

+  // navigating to a new SiteInstance. Since that node's navigation will replace

[awong, 2014/09/03 21:58:38]

"this nodes" -> |source|'s

[nasko, 2014/09/03 23:50:19]

Done.

+  // the currently loaded document, the entire subtree under the node will be

[awong, 2014/09/03 21:58:38]

the node -> |source|

[nasko, 2014/09/03 23:50:19]

Done.

+  // removed.
+  ForEach(base::Bind(&CreateProxyForSiteInstance, instance), source);
 }
 
 void FrameTree::ResetForMainFrameSwap() {
   root_->ResetForNewProcess();
   focused_frame_tree_node_id_ = -1;
 }
 
 void FrameTree::RenderProcessGone(RenderViewHost* render_view_host) {
   // Walk the full tree looking for nodes that may be affected.  Once a frame
   // crashes, all of its child FrameTreeNodes go away.
@@ skipping 115 matching lines @@
         rvh->Shutdown();
         render_view_host_pending_shutdown_map_.erase(multi_iter);
       }
       break;
     }
     CHECK(render_view_host_found);
   }
 }
 
 }  // namespace content