Invert the owning relationship between WebFrame and Frame.

Source/web/FrameLoaderClientImpl.cpp

 /*
  * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 92 matching lines @@
 
 FrameLoaderClientImpl::FrameLoaderClientImpl(WebFrameImpl* frame)
     : m_webFrame(frame)
 {
 }
 
 FrameLoaderClientImpl::~FrameLoaderClientImpl()
 {
 }
 
-void FrameLoaderClientImpl::frameLoaderDestroyed()
-{
-    // When the WebFrame was created, it had an extra reference given to it on
-    // behalf of the Frame.  Since the WebFrame owns us, this extra ref also
-    // serves to keep us alive until the FrameLoader is done with us.  The
-    // FrameLoader calls this method when it's going away.  Therefore, we balance
-    // out that extra reference, which may cause 'this' to be deleted.
-    ASSERT(!m_webFrame->frame());
-    m_webFrame->deref();
-}
-
 void FrameLoaderClientImpl::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*)
 {
     if (m_webFrame->client()) {
         m_webFrame->client()->didClearWindowObject(m_webFrame);
         Document* document = m_webFrame->frame()->document();
         if (document) {
             WheelController::from(document);
             if (RuntimeEnabledFeatures::deviceMotionEnabled())
                 DeviceMotionController::from(document);
             if (RuntimeEnabledFeatures::deviceOrientationEnabled())
@@ skipping 112 matching lines @@
 }
 
 bool FrameLoaderClientImpl::hasFrameView() const
 {
     // The Mac port has this notion of a WebFrameView, which seems to be
     // some wrapper around an NSView.  Since our equivalent is HWND, I guess
     // we have a "frameview" whenever we have the toplevel HWND.
     return m_webFrame->viewImpl();
 }
 
+void FrameLoaderClientImpl::willDetachParent()
+{
+    m_webFrame->willDetachParent();
+}
+
 void FrameLoaderClientImpl::detachedFromParent()
 {
-    // Close down the proxy.  The purpose of this change is to make the
-    // call to ScriptController::clearWindowShell a no-op when called from
-    // Frame::pageDestroyed.  Without this change, this call to clearWindowShell
-    // will cause a crash.  If you remove/modify this, just ensure that you can
-    // go to a page and then navigate to a new page without getting any asserts
-    // or crashes.
-    m_webFrame->frame()->script().clearForClose();
-
     // Alert the client that the frame is being detached. This is the last
     // chance we have to communicate with the client.
-    if (m_webFrame->client())
-        m_webFrame->client()->frameDetached(m_webFrame);
+    m_webFrame->setWebCoreFrame(0);
 
-    // Stop communicating with the WebFrameClient at this point since we are no
-    // longer associated with the Page.
+    // Signal that no further communication with WebFrameClient should take
+    // place at this point since we are no longer associated with the Page.
+    WebFrameClient* client = m_webFrame->client();
     m_webFrame->setClient(0);
+
+    // The call to WebFrameClient::frameDetached() is generally when the embedder will release its
+    // reference to the WebFrame, which may trigger WebFrame destruction. Since WebFrame owns
+    // FrameLoaderClientImpl, we must not access any of our own members after this call, since this
+    // object may have been destroyed.
+    WebFrame* webFrame = m_webFrame;
+    m_webFrame = 0;
+    client->frameDetached(webFrame);
 }
 
 void FrameLoaderClientImpl::dispatchWillRequestAfterPreconnect(ResourceRequest& request)
 {
     if (m_webFrame->client()) {
         WrappedResourceRequest webreq(request);
         m_webFrame->client()->willRequestAfterPreconnect(m_webFrame, webreq);
     }
 }
 
@@ skipping 494 matching lines @@
     return m_webFrame->sharedWorkerRepositoryClient();
 }
 
 void FrameLoaderClientImpl::didStopAllLoaders()
 {
     if (m_webFrame->client())
         m_webFrame->client()->didAbortLoading(m_webFrame);
 }
 
 } // namespace blink