RenderFrameHostImpl::JavaScriptDialogClosed uses is_waiting_for_beforeunload_ack_ as a proxy for whether we're in an onbeforeunload (e.g.

RenderFrameHostImpl::DispatchBeforeUnload sets is_waiting_for_beforeunload_ack_
RenderFrameHostImpl::DispatchBeforeUnload starts the beforeunload timer
RenderFrameHostImpl::DispatchBeforeUnload sends FrameMsg_BeforeUnload
The render frame sends back FrameHostMsg_RunBeforeUnloadConfirm
RenderFrameHostImpl::OnRunBeforeUnloadConfirm stops the hang monitor timeout
RenderFrameHostImpl::JavaScriptDialogClosed restarts the beforeunload timer )

The problem is that when we moved JavaScriptDialogClosed to the frame we didn't account for that. So if a subframe has an onbeforeunload handler, inside of JavaScriptDialogClosed, is_waiting_for_beforeunload_ack_ isn't set and the timer doesn't get restarted.