Invert the owning relationship between WebFrame and Frame.

Source/core/inspector/InspectorOverlay.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 663 matching lines @@
     update();
 }
 
 bool InspectorOverlay::getBoxModel(Node* node, Vector<FloatQuad>* quads)
 {
     return buildNodeQuads(node, *quads);
 }
 
 void InspectorOverlay::freePage()
 {
-    m_overlayPage.clear();
+    if (m_overlayPage) {
+        m_overlayPage->mainFrame()->loader().frameDetached();

[eseidel, 2013/12/28 01:18:40]

Is it too late to do this during Page destruction?  We should add a comment as
to why this explicit call is necessary.

[dcheng, 2013/12/28 01:51:05]

One possible alternative is to move this into Page's destructor. I didn't do
this and chose to just mirror the existing structure of SVGImage/WebViewImpl.

Since it seems kind of silly to put a comment in all three locations (and the
comment would reference code in seemingly unrelated bits of Blink), I've added a
FIXME to investigate moving this common logic into Page.

+        m_overlayPage.clear();
+    }
     m_overlayChromeClient.clear();
     m_timer.stop();
 }
 
 void InspectorOverlay::startedRecordingProfile()
 {
     if (!m_activeProfilerCount++)
         freePage();
 }
 
 } // namespace WebCore