Do not create proxy hosts in the subtree of navigating frame.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 1275 matching lines @@
       old_render_frame_host.get(), render_frame_host_.get(), is_main_frame);
 
   // Swap out the old frame now that the new one is visible.
   // This will swap it out and then put it on the proxy list (if there are other
   // active views in its SiteInstance) or schedule it for deletion when the swap
   // out ack arrives (or immediately if the process isn't live).
   // In the --site-per-process case, old subframe RHFs are not kept alive inside
   // the proxy.
   SwapOutOldFrame(old_render_frame_host.Pass());
 
-  // If this is a subframe, it should have a CrossProcessFrameConnector
-  // created already.  Use it to link the new RFH's view to the proxy that
-  // belongs to the parent frame's SiteInstance.
-  // Note: We do this after swapping out the old RFH because that may create the
-  // proxy we're looking for.
   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess) &&
       !is_main_frame) {
+    // If this is a subframe, it should have a CrossProcessFrameConnector
+    // created already.  Use it to link the new RFH's view to the proxy that
+    // belongs to the parent frame's SiteInstance.
+    // Note: We do this after swapping out the old RFH because that may create
+    // the proxy we're looking for.
     RenderFrameProxyHost* proxy_to_parent = GetProxyToParent();
     if (proxy_to_parent) {
       proxy_to_parent->SetChildRWHView(
           render_frame_host_->render_view_host()->GetView());
     }
+
+    // Since the new RenderFrameHost is now committed, there must be no proxies
+    // for its SiteInstance. Delete any existing ones.
+    RenderFrameProxyHostMap::iterator iter =
+        proxy_hosts_.find(render_frame_host_->GetSiteInstance()->GetId());
+    if (iter != proxy_hosts_.end()) {
+      delete iter->second;
+      proxy_hosts_.erase(iter);
+    }
   }
+
+  // After all is done, there must never be a proxy in the list which has the
+  // same SiteInstance as the current RenderFrameHost.
+  CHECK(proxy_hosts_.find(render_frame_host_->GetSiteInstance()->GetId()) ==
+        proxy_hosts_.end());
 }
 
 void RenderFrameHostManager::ShutdownRenderFrameProxyHostsInSiteInstance(
     int32 site_instance_id) {
   // First remove any swapped out RFH for this SiteInstance from our own list.
   ClearProxiesInSiteInstance(site_instance_id, frame_tree_node_);
 
   // Use the safe RenderWidgetHost iterator for now to find all RenderViewHosts
   // in the SiteInstance, then tell their respective FrameTrees to remove all
   // RenderFrameProxyHosts corresponding to them.
@@ skipping 272 matching lines @@
 void RenderFrameHostManager::DeleteRenderFrameProxyHost(
     SiteInstance* instance) {
   RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(instance->GetId());
   if (iter != proxy_hosts_.end()) {
     delete iter->second;
     proxy_hosts_.erase(iter);
   }
 }
 
 }  // namespace content