Invert the owning relationship between WebFrame and Frame.

Source/bindings/v8/V8WindowShell.cpp

 /*
  * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 80 matching lines @@
 
 void V8WindowShell::disposeContext(GlobalDetachmentBehavior behavior)
 {
     m_perContextData.clear();
 
     if (!m_contextHolder)
         return;
 
     v8::HandleScope handleScope(m_isolate);
     v8::Handle<v8::Context> context = m_contextHolder->context();
-    m_frame->loader().client()->willReleaseScriptContext(context, m_world->worldId());
+    // FIXME: This is probably wrong.

[eseidel, 2013/12/21 01:17:34]

A bit more context?

[dcheng, 2013/12/28 01:04:29]

I've found a better way to fix this. Normally, this gets invoked during frame
detach by FrameLoaderClientImpl. The problem is that certain things like
SVGImage have a main frame, but just use EmptyFrameLoaderClient. To fix this, I
moved the call to ScriptController::clearForClose() from FrameLoaderClientImpl
into FrameLoader and added an assert that it was called before ScriptController
is destroyed. I also had to update the inspector overlay to tear down its Page
the same way as well.

+    if (m_frame->loader().client())
+        m_frame->loader().client()->willReleaseScriptContext(context, m_world->worldId());
 
     if (behavior == DetachGlobal)
         context->DetachGlobal();
 
     m_contextHolder.clear();
 
     // It's likely that disposing the context has created a lot of
     // garbage. Notify V8 about this so it'll have a chance of cleaning
     // it up when idle.
     V8GCForContextDispose::instanceTemplate().notifyContextDisposed(m_frame->isMainFrame());
@@ skipping 388 matching lines @@
 void V8WindowShell::updateSecurityOrigin()
 {
     ASSERT(m_world->isMainWorld());
     if (!m_contextHolder)
         return;
     v8::HandleScope handleScope(m_isolate);
     setSecurityToken();
 }
 
 } // WebCore