Shutdown RenderWidgetHost owned by RenderFrameHost when destroying the RenderFrameHost.

This is needed because the RenderThread in the renderer process owns a reference to the RenderWidget, and that reference is only released when the RenderWidgetHost sends ViewMsg_Close, which happens on RenderWidgetHost::Shutdown.

BUG=464764

Review URL: https://codereview.chromium.org/1052223008

Cr-Commit-Position: refs/heads/master@{#327331}

content/browser/frame_host/render_frame_host_impl.cc

@@ -149,6 +149,7 @@ RenderFrameHostImpl::RenderFrameHostImpl(SiteInstance* site_instance,
       render_frame_proxy_host_(NULL),
       frame_tree_(frame_tree),
       frame_tree_node_(frame_tree_node),
+      render_widget_host_(nullptr),
       routing_id_(routing_id),
       render_frame_created_(false),
       navigations_suspended_(false),
@@ -180,8 +181,8 @@ RenderFrameHostImpl::RenderFrameHostImpl(SiteInstance* site_instance,
       &RenderFrameHostImpl::OnSwappedOut, weak_ptr_factory_.GetWeakPtr())));
 
   if (flags & CREATE_RF_NEEDS_RENDER_WIDGET_HOST) {
-    render_widget_host_.reset(new RenderWidgetHostImpl(
-        rwh_delegate, GetProcess(), MSG_ROUTING_NONE, hidden));
+    render_widget_host_ = new RenderWidgetHostImpl(rwh_delegate, GetProcess(),
+                                                   MSG_ROUTING_NONE, hidden);
     render_widget_host_->set_owned_by_render_frame_host(true);
   }
 }
@@ -213,8 +214,10 @@ RenderFrameHostImpl::~RenderFrameHostImpl() {
     iter.second.Run(false);
   }
 
-  if (render_widget_host_)
-    render_widget_host_->Cleanup();
+  if (render_widget_host_) {
+    // Shutdown causes the RenderWidgetHost to delete itself.
+    render_widget_host_->Shutdown();
+  }
 }
 
 int RenderFrameHostImpl::GetRoutingID() {
@@ -596,7 +599,7 @@ bool RenderFrameHostImpl::CreateRenderFrame(int parent_routing_id,
   // lifetime of the current RenderProcessHost for this RenderFrameHost.
   if (render_widget_host_) {
     RenderWidgetHostView* rwhv =
-        new RenderWidgetHostViewChildFrame(render_widget_host_.get());
+        new RenderWidgetHostViewChildFrame(render_widget_host_);
     rwhv->Hide();
   }
 
@@ -871,7 +874,7 @@ void RenderFrameHostImpl::OnDidDropNavigation() {
 
 RenderWidgetHostImpl* RenderFrameHostImpl::GetRenderWidgetHost() {
   if (render_widget_host_)
-    return render_widget_host_.get();
+    return render_widget_host_;
 
   // TODO(kenrb): When RenderViewHost no longer inherits RenderWidgetHost,
   // we can remove this fallback. Currently it is only used for the main

content/browser/frame_host/render_frame_host_impl.h

@@ -627,7 +627,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // frames.
   // TODO(kenrb): Later this will also be used on the top-level frame, when
   // RenderFrameHost owns its RenderViewHost.
-  scoped_ptr<RenderWidgetHostImpl> render_widget_host_;
+  RenderWidgetHostImpl* render_widget_host_;
 
   int routing_id_;
 

content/browser/renderer_host/render_widget_host_impl.cc

@@ -1336,13 +1336,6 @@ void RenderWidgetHostImpl::SetAutoResize(bool enable,
   max_size_for_auto_resize_ = max_size;
 }
 
-void RenderWidgetHostImpl::Cleanup() {
-  if (view_) {
-    view_->Destroy();
-    view_ = nullptr;
-  }
-}
-
 void RenderWidgetHostImpl::Destroy() {
   NotificationService::current()->Notify(
       NOTIFICATION_RENDER_WIDGET_HOST_DESTROYED,

content/browser/renderer_host/render_widget_host_impl.h

@@ -201,9 +201,6 @@ class CONTENT_EXPORT RenderWidgetHostImpl
     owned_by_render_frame_host_ = owned_by_rfh;
   }
 
-  // Called by RenderFrameHost before destroying this object.
-  void Cleanup();
-
   // Tells the renderer to die and then calls Destroy().
   virtual void Shutdown();
 

content/renderer/render_frame_impl.cc

@@ -2224,8 +2224,13 @@ void RenderFrameImpl::frameDetached(blink::WebFrame* frame) {
   CHECK_EQ(it->second, this);
   g_frame_map.Get().erase(it);
 
-  if (is_subframe)
+  if (is_subframe) {
+    if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+            switches::kSitePerProcess) && render_widget_) {
+      render_widget_->UnregisterRenderFrame(this);
+    }
     frame->parent()->removeChild(frame);
+  }
 
   // |frame| is invalid after here.  Be sure to clear frame_ as well, since this
   // object may not be deleted immediately and other methods may try to access