Do not create proxy hosts in the subtree of navigating frame.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 4c2b565a1fd8b919e5313972ea2de4cba307525d..37997ac276e9374024fd8c4b865924b92aca6b76 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -1293,19 +1293,33 @@ void RenderFrameHostManager::CommitPending() {
   // the proxy.
   SwapOutOldFrame(old_render_frame_host.Pass());
 
-  // If this is a subframe, it should have a CrossProcessFrameConnector
-  // created already.  Use it to link the new RFH's view to the proxy that
-  // belongs to the parent frame's SiteInstance.
-  // Note: We do this after swapping out the old RFH because that may create the
-  // proxy we're looking for.
   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess) &&
       !is_main_frame) {
+    // If this is a subframe, it should have a CrossProcessFrameConnector
+    // created already.  Use it to link the new RFH's view to the proxy that
+    // belongs to the parent frame's SiteInstance.
+    // Note: We do this after swapping out the old RFH because that may create
+    // the proxy we're looking for.
     RenderFrameProxyHost* proxy_to_parent = GetProxyToParent();
     if (proxy_to_parent) {
       proxy_to_parent->SetChildRWHView(
           render_frame_host_->render_view_host()->GetView());
     }
+
+    // Since the new RenderFrameHost is now committed, there must be no proxies
+    // for its SiteInstance. Delete any existing ones.
+    RenderFrameProxyHostMap::iterator iter =
+        proxy_hosts_.find(render_frame_host_->GetSiteInstance()->GetId());
+    if (iter != proxy_hosts_.end()) {
+      delete iter->second;
+      proxy_hosts_.erase(iter);
+    }
   }
+
+  // After all is done, there must never be a proxy in the list which has the
+  // same SiteInstance as the current RenderFrameHost.
+  CHECK(proxy_hosts_.find(render_frame_host_->GetSiteInstance()->GetId()) ==
+        proxy_hosts_.end());
 }
 
 void RenderFrameHostManager::ShutdownRenderFrameProxyHostsInSiteInstance(