bfcache: Do not leak sub-document RenderFrameHost.

There was a bug in RenderFrameHost::DeleteRenderFrameHost().

Bug: 992894
Change-Id: I0fb3171814113a57ac2267a4442cf252d47d4de8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1807234Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#697133}

content/browser/frame_host/render_frame_host_impl.cc

@@ -1897,7 +1897,7 @@ bool RenderFrameHostImpl::CreateRenderFrame(int previous_routing_id,
 }
 
 void RenderFrameHostImpl::DeleteRenderFrame(FrameDeleteIntention intent) {
-  if (!is_active())
+  if (unload_state_ != UnloadState::NotRun)
     return;
 
   if (render_frame_created_) {

testing/buildbot/filters/bfcache.browser_tests.filter

@@ -20,9 +20,3 @@
 
 # Very flaky. Can't reproduce locally, it always succeed.
 -SystemNetworkContextManagerMaxConnectionsPerProxyBrowsertest.MaxConnectionsPerProxy
-
-# RenderWidget owned by an iframe used OnClose() method.
-# Check failed: popup_ || pepper_fullscreen_.
-# https://crbug.com/992891
--DeclarativeNetRequestBrowserTest.BlockRequests_Domains/0
--DeclarativeNetRequestBrowserTest.BlockRequests_Domains/1