Subframes in inner WebContents should not create proxies in process of outer WebContents.

content/browser/frame_host/render_frame_proxy_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 
 #include "base/lazy_instance.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/frame_tree.h"
@@ skipping 40 matching lines @@
       process_(site_instance->GetProcess()),
       frame_tree_node_(frame_tree_node),
       render_frame_proxy_created_(false),
       render_view_host_(render_view_host) {
   GetProcess()->AddRoute(routing_id_, this);
   CHECK(g_routing_id_frame_proxy_map.Get().insert(
       std::make_pair(
           RenderFrameProxyHostID(GetProcess()->GetID(), routing_id_),
           this)).second);
   CHECK_IMPLIES(!render_view_host,
-                frame_tree_node_->render_manager()->ForInnerDelegate());
+                frame_tree_node_->render_manager()->ForInnerDelegate() &&
+                    frame_tree_node_->IsMainFrame());
   if (render_view_host)
     frame_tree_node_->frame_tree()->AddRenderViewHostRef(render_view_host_);
 
   bool is_proxy_to_parent = !frame_tree_node_->IsMainFrame() &&
                             frame_tree_node_->parent()
                                     ->render_manager()
                                     ->current_frame_host()
                                     ->GetSiteInstance() == site_instance;
+  bool is_proxy_to_outer_delegate =
+      frame_tree_node_->IsMainFrame() &&
+      frame_tree_node_->render_manager()->ForInnerDelegate();
 
   // If this is a proxy to parent frame or this proxy is for the inner
   // WebContents's FrameTreeNode in outer WebContents's SiteInstance, then we
   // need a CrossProcessFrameConnector.
-  if (is_proxy_to_parent ||
-      frame_tree_node_->render_manager()->ForInnerDelegate()) {
+  if (is_proxy_to_parent || is_proxy_to_outer_delegate) {
     // The RenderFrameHost navigating cross-process is destroyed and a proxy for
     // it is created in the parent's process. CrossProcessFrameConnector
     // initialization only needs to happen on an initial cross-process
     // navigation, when the RenderFrameHost leaves the same process as its
     // parent. The same CrossProcessFrameConnector is used for subsequent cross-
     // process navigations, but it will be destroyed if the frame is
     // navigated back to the same SiteInstance as its parent.
     cross_process_frame_connector_.reset(new CrossProcessFrameConnector(this));
   }
 }
@@ skipping 106 matching lines @@
   render_frame_proxy_created_ = true;
   return true;
 }
 
 void RenderFrameProxyHost::DisownOpener() {
   Send(new FrameMsg_DisownOpener(GetRoutingID()));
 }
 
 void RenderFrameProxyHost::OnDetach() {
   if (frame_tree_node_->render_manager()->ForInnerDelegate()) {
+    // Only main frame proxy can detach for inner WebContents.
+    DCHECK(frame_tree_node_->IsMainFrame());
     frame_tree_node_->render_manager()->RemoveOuterDelegateFrame();
     return;
   }
 
   // This message should only be received for subframes.  Note that we can't
   // restrict it to just the current SiteInstances of the ancestors of this
   // frame, because another frame in the tree may be able to detach this frame
   // by navigating its parent.
   if (frame_tree_node_->IsMainFrame()) {
     bad_message::ReceivedBadMessage(GetProcess(), bad_message::RFPH_DETACH);
@@ skipping 75 matching lines @@
         base::Bind(&MessagePortMessageFilter::RouteMessageEventWithMessagePorts,
                    message_port_message_filter, target_rfh->GetRoutingID(),
                    new_params));
   } else {
     target_rfh->Send(
         new FrameMsg_PostMessageEvent(target_rfh->GetRoutingID(), new_params));
   }
 }
 
 }  // namespace content