Fix RenderFrameHostImpl::OnDetach() for IPC fuzzer.

RenderFrameHostImpl::OnDetach() is not expected to be called for the
main frame. |parent| was not checked. It used to be checked in
FrameTree::RemoveFrame, but this function is no more used in OnDetach.

Bug: 902964
Change-Id: I8ec758dfcc7a382f3d3ec6554ea94ad857c5a6e3
Reviewed-on: https://chromium-review.googlesource.com/c/1348449
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#610816}

content/browser/bad_message.h

@@ -235,6 +235,7 @@ enum BadMessageReason {
   RFH_CANNOT_RENDER_FALLBACK_CONTENT = 207,
   RFH_CHILD_FRAME_NEEDS_OWNER_ELEMENT_TYPE = 208,
   RFH_INVALID_WEB_REPORTING_CRASH_ID = 209,
+  RFH_DETACH_MAIN_FRAME = 210,
 
   // Please add new elements here. The naming convention is abbreviated class
   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the

content/browser/frame_host/render_frame_host_impl.cc

@@ -1909,6 +1909,12 @@ void RenderFrameHostImpl::SetLastCommittedUrl(const GURL& url) {
 }
 
 void RenderFrameHostImpl::OnDetach() {
+  if (!parent_) {
+    bad_message::ReceivedBadMessage(GetProcess(),
+                                    bad_message::RFH_DETACH_MAIN_FRAME);
+    return;
+  }
+
   // If this frame is pending deletion, OnDetach() is the ACK this
   // RenderFrameHost is waiting for before going into the "Deleted" state.
   if (!is_active() && !is_waiting_for_swapout_ack_) {

tools/metrics/histograms/enums.xml

@@ -3672,6 +3672,7 @@ uploading your change for review.  These are checked by presubmit scripts.
   <int value="207" label="RFH_CANNOT_RENDER_FALLBACK_CONTENT"/>
   <int value="208" label="RFH_CHILD_FRAME_NEEDS_OWNER_ELEMENT_TYPE"/>
   <int value="209" label="RFH_INVALID_WEB_REPORTING_CRASH_ID"/>
+  <int value="210" label="RFH_DETACH_MAIN_FRAME"/>
 </enum>
 
 <enum name="BadMessageReasonExtensions">