Detach RemoteFrame from the tree when deleting RenderFrameProxy.

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <map>
 
 #include "base/lazy_instance.h"
 #include "content/child/webmessageportchannel_impl.h"
@@ skipping 100 matching lines @@
 RenderFrameProxy::~RenderFrameProxy() {
   render_view()->UnregisterRenderFrameProxy(this);
 
   FrameMap::iterator it = g_frame_map.Get().find(web_frame_);
   CHECK(it != g_frame_map.Get().end());
   CHECK_EQ(it->second, this);
   g_frame_map.Get().erase(it);
 
   RenderThread::Get()->RemoveRoute(routing_id_);
   g_routing_id_proxy_map.Get().erase(routing_id_);
-
-  // TODO(nick): Call close unconditionally when web_frame() is always remote.
-  if (web_frame()->isWebRemoteFrame())
-    web_frame()->close();
 }
 
 void RenderFrameProxy::Init(blink::WebRemoteFrame* web_frame,
                             RenderViewImpl* render_view) {
   CHECK(web_frame);
   CHECK(render_view);
 
   web_frame_ = web_frame;
   render_view_ = render_view;
 
@@ skipping 36 matching lines @@
     return false;
   }
   message->set_routing_id(routing_id_);
   return RenderThread::Get()->Send(message);
 }
 
 void RenderFrameProxy::OnDeleteProxy() {
   RenderFrameImpl* render_frame =
       RenderFrameImpl::FromRoutingID(frame_routing_id_);
 
-  if (render_frame)
+  // If this is a proxy for the top-level frame, the RenderFrame will clean it
+  // up, so only unregister for subframes.
+  if (render_frame && web_frame_->parent())

[Charlie Reis, 2014/10/16 23:17:56]

Seems like render_frame wouldn't exist if this were a subframe.  Perhaps we want
to remove this whole block, including set_render_frame_proxy(NULL)?

[nasko, 2014/10/16 23:21:09]

Done.

     render_frame->set_render_frame_proxy(NULL);
 
-  delete this;
+  DCHECK(web_frame_->isWebRemoteFrame());
+  web_frame_->detach();
 }
 
 void RenderFrameProxy::OnChildFrameProcessGone() {
   if (compositing_helper_.get())
     compositing_helper_->ChildFrameGone();
 }
 
 void RenderFrameProxy::OnCompositorFrameSwapped(const IPC::Message& message) {
   FrameMsg_CompositorFrameSwapped::Param param;
   if (!FrameMsg_CompositorFrameSwapped::Read(&message, &param))
@@ skipping 28 matching lines @@
   if (render_frame) {
     if (render_frame->GetWebFrame()->opener())
       render_frame->GetWebFrame()->setOpener(NULL);
     return;
   }
 
   if (web_frame_->opener())
     web_frame_->setOpener(NULL);
 }
 
+void RenderFrameProxy::frameDetached() {
+  if (web_frame_->parent())
+    web_frame_->parent()->removeChild(web_frame_);
+
+  web_frame_->close();
+  delete this;
+}
+
 void RenderFrameProxy::postMessageEvent(
     blink::WebLocalFrame* source_frame,
     blink::WebRemoteFrame* target_frame,
     blink::WebSecurityOrigin target_origin,
     blink::WebDOMMessageEvent event) {
   DCHECK(!web_frame_ || web_frame_ == target_frame);
 
   ViewMsg_PostMessage_Params params;
   params.is_data_raw_string = false;
   params.data = event.data().toString();
@@ skipping 49 matching lines @@
       blink::WebUserGestureIndicator::isProcessingUserGesture();
   blink::WebUserGestureIndicator::consumeUserGesture();
   Send(new FrameHostMsg_OpenURL(routing_id_, params));
 }
 
 void RenderFrameProxy::forwardInputEvent(const blink::WebInputEvent* event) {
   Send(new FrameHostMsg_ForwardInputEvent(routing_id_, event));
 }
 
 }  // namespace