Invert the owning relationship between WebFrame and Frame.

Source/web/FrameLoaderClientImpl.cpp

Index: Source/web/FrameLoaderClientImpl.cpp
diff --git a/Source/web/FrameLoaderClientImpl.cpp b/Source/web/FrameLoaderClientImpl.cpp
index b9c348639719e4f7c955c0d69125252da1810bd8..496503c00812fa11fe1b62b1d9996da35186e28c 100644
--- a/Source/web/FrameLoaderClientImpl.cpp
+++ b/Source/web/FrameLoaderClientImpl.cpp
@@ -110,17 +110,6 @@ FrameLoaderClientImpl::~FrameLoaderClientImpl()
 {
 }
 
-void FrameLoaderClientImpl::frameLoaderDestroyed()
-{
-    // When the WebFrame was created, it had an extra reference given to it on
-    // behalf of the Frame.  Since the WebFrame owns us, this extra ref also
-    // serves to keep us alive until the FrameLoader is done with us.  The
-    // FrameLoader calls this method when it's going away.  Therefore, we balance
-    // out that extra reference, which may cause 'this' to be deleted.
-    ASSERT(!m_webFrame->frame());
-    m_webFrame->deref();
-}
-
 void FrameLoaderClientImpl::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*)
 {
     if (m_webFrame->client()) {
@@ -253,6 +242,11 @@ bool FrameLoaderClientImpl::hasFrameView() const
     return m_webFrame->viewImpl();
 }
 
+void FrameLoaderClientImpl::willDetachParent()
+{
+    m_webFrame->willDetachParent();
+}
+
 void FrameLoaderClientImpl::detachedFromParent()
 {
     // Close down the proxy.  The purpose of this change is to make the
@@ -263,14 +257,21 @@ void FrameLoaderClientImpl::detachedFromParent()
     // or crashes.
     m_webFrame->frame()->script().clearForClose();
 
-    // Alert the client that the frame is being detached. This is the last
+    // Now alert the client that the frame is being detached. This is the last
     // chance we have to communicate with the client.
-    if (m_webFrame->client())
-        m_webFrame->client()->frameDetached(m_webFrame);
+    m_webFrame->setWebCoreFrame(0);
 
-    // Stop communicating with the WebFrameClient at this point since we are no
-    // longer associated with the Page.
+    // Signal that no further communication with WebFrameClient should take
+    // place at this point since we are no longer associated with the Page.
+    WebFrameClient* client = m_webFrame->client();
     m_webFrame->setClient(0);
+
+    // frameDetached() may release the final reference to WebFrame. Since we are
+    // owned by WebFrame, we can't reference any members after this point, so
+    // clear WebFrame now.
+    WebFrame* webFrame = m_webFrame;
+    m_webFrame = 0;
+    client->frameDetached(webFrame);
 }
 
 void FrameLoaderClientImpl::dispatchWillRequestAfterPreconnect(ResourceRequest& request)