Invert the owning relationship between WebFrame and Frame.

Source/bindings/v8/V8WindowShell.cpp

Index: Source/bindings/v8/V8WindowShell.cpp
diff --git a/Source/bindings/v8/V8WindowShell.cpp b/Source/bindings/v8/V8WindowShell.cpp
index 3474312da865a31882e26d8d307b99c7698758a0..dd4a89e0de2c0b278055223d85d546245094179c 100644
--- a/Source/bindings/v8/V8WindowShell.cpp
+++ b/Source/bindings/v8/V8WindowShell.cpp
@@ -98,7 +98,9 @@ void V8WindowShell::disposeContext(GlobalDetachmentBehavior behavior)
 
     v8::HandleScope handleScope(m_isolate);
     v8::Handle<v8::Context> context = m_contextHolder->context();
-    m_frame->loader().client()->willReleaseScriptContext(context, m_world->worldId());
+    // FIXME: This is probably wrong.

[eseidel, 2013/12/21 01:17:34]

A bit more context?

[dcheng, 2013/12/28 01:04:29]

I've found a better way to fix this. Normally, this gets invoked during frame
detach by FrameLoaderClientImpl. The problem is that certain things like
SVGImage have a main frame, but just use EmptyFrameLoaderClient. To fix this, I
moved the call to ScriptController::clearForClose() from FrameLoaderClientImpl
into FrameLoader and added an assert that it was called before ScriptController
is destroyed. I also had to update the inspector overlay to tear down its Page
the same way as well.

+    if (m_frame->loader().client())
+        m_frame->loader().client()->willReleaseScriptContext(context, m_world->worldId());
 
     if (behavior == DetachGlobal)
         context->DetachGlobal();