Detach RemoteFrame from the tree when deleting RenderFrameProxy.

BUG=414675

Review URL: https://codereview.chromium.org/660093003

Cr-Commit-Position: refs/heads/master@{#300057}

4 files changed, 22 insertions, 13 deletions

diff --git a/content/browser/frame_host/render_frame_proxy_host.cc b/content/browser/frame_host/render_frame_proxy_host.cc
index af86c2f..3db9edf 100644
--- a/content/browser/frame_host/render_frame_proxy_host.cc
+++ b/content/browser/frame_host/render_frame_proxy_host.cc
@@ -68,8 +68,14 @@ RenderFrameProxyHost::RenderFrameProxyHost(SiteInstance* site_instance,
 }
 
 RenderFrameProxyHost::~RenderFrameProxyHost() {
-  if (GetProcess()->HasConnection())
-    Send(new FrameMsg_DeleteProxy(routing_id_));
+  if (GetProcess()->HasConnection()) {
+    // TODO(nasko): For now, don't send this IPC for top-level frames, as
+    // the top-level RenderFrame will delete the RenderFrameProxy.
+    // This can be removed once we don't have a swapped out state on
+    // RenderFrame. See https://crbug.com/357747
+    if (!frame_tree_node_->IsMainFrame())
+      Send(new FrameMsg_DeleteProxy(routing_id_));
+  }
 
   GetProcess()->RemoveRoute(routing_id_);
   g_routing_id_frame_proxy_map.Get().erase(
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 0773d41..1ebf72a 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -598,6 +598,9 @@ RenderFrameImpl::~RenderFrameImpl() {
     render_view_->UnregisterVideoHoleFrame(this);
 #endif
 
+  if (render_frame_proxy_)
+    delete render_frame_proxy_;
+
   render_view_->UnregisterRenderFrame(this);
   g_routing_id_frame_map.Get().erase(routing_id_);
   RenderThread::Get()->RemoveRoute(routing_id_);
diff --git a/content/renderer/render_frame_proxy.cc b/content/renderer/render_frame_proxy.cc
index 77f7eaa..6b8c760 100644
--- a/content/renderer/render_frame_proxy.cc
+++ b/content/renderer/render_frame_proxy.cc
@@ -118,10 +118,6 @@ RenderFrameProxy::~RenderFrameProxy() {
 
   RenderThread::Get()->RemoveRoute(routing_id_);
   g_routing_id_proxy_map.Get().erase(routing_id_);
-
-  // TODO(nick): Call close unconditionally when web_frame() is always remote.
-  if (web_frame()->isWebRemoteFrame())
-    web_frame()->close();
 }
 
 void RenderFrameProxy::Init(blink::WebRemoteFrame* web_frame,
@@ -175,13 +171,8 @@ bool RenderFrameProxy::Send(IPC::Message* message) {
 }
 
 void RenderFrameProxy::OnDeleteProxy() {
-  RenderFrameImpl* render_frame =
-      RenderFrameImpl::FromRoutingID(frame_routing_id_);
-
-  if (render_frame)
-    render_frame->set_render_frame_proxy(NULL);
-
-  delete this;
+  DCHECK(web_frame_->isWebRemoteFrame());
+  web_frame_->detach();
 }
 
 void RenderFrameProxy::OnChildFrameProcessGone() {
@@ -230,6 +221,14 @@ void RenderFrameProxy::OnDisownOpener() {
     web_frame_->setOpener(NULL);
 }
 
+void RenderFrameProxy::frameDetached() {
+  if (web_frame_->parent())
+    web_frame_->parent()->removeChild(web_frame_);
+
+  web_frame_->close();
+  delete this;
+}
+
 void RenderFrameProxy::postMessageEvent(
     blink::WebLocalFrame* source_frame,
     blink::WebRemoteFrame* target_frame,
diff --git a/content/renderer/render_frame_proxy.h b/content/renderer/render_frame_proxy.h
index 0eb01c4..409d74e 100644
--- a/content/renderer/render_frame_proxy.h
+++ b/content/renderer/render_frame_proxy.h
@@ -98,6 +98,7 @@ class CONTENT_EXPORT RenderFrameProxy
   blink::WebRemoteFrame* web_frame() { return web_frame_; }
 
   // blink::WebRemoteFrameClient implementation:
+  virtual void frameDetached();
   virtual void postMessageEvent(
       blink::WebLocalFrame* sourceFrame,
       blink::WebRemoteFrame* targetFrame,