Invert the owning relationship between WebFrame and Frame.

Source/core/inspector/InspectorOverlay.cpp

Index: Source/core/inspector/InspectorOverlay.cpp
diff --git a/Source/core/inspector/InspectorOverlay.cpp b/Source/core/inspector/InspectorOverlay.cpp
index 34f6c98f593fae0a8bebd06c7e3046fa38830b03..ab5430dac594e453bac480c5516d5c37a47859af 100644
--- a/Source/core/inspector/InspectorOverlay.cpp
+++ b/Source/core/inspector/InspectorOverlay.cpp
@@ -681,7 +681,10 @@ bool InspectorOverlay::getBoxModel(Node* node, Vector<FloatQuad>* quads)
 
 void InspectorOverlay::freePage()
 {
-    m_overlayPage.clear();
+    if (m_overlayPage) {
+        m_overlayPage->mainFrame()->loader().frameDetached();

[eseidel, 2013/12/28 01:18:40]

Is it too late to do this during Page destruction?  We should add a comment as
to why this explicit call is necessary.

[dcheng, 2013/12/28 01:51:05]

One possible alternative is to move this into Page's destructor. I didn't do
this and chose to just mirror the existing structure of SVGImage/WebViewImpl.

Since it seems kind of silly to put a comment in all three locations (and the
comment would reference code in seemingly unrelated bits of Blink), I've added a
FIXME to investigate moving this common logic into Page.

+        m_overlayPage.clear();
+    }
     m_overlayChromeClient.clear();
     m_timer.stop();
 }