Gracefully handle a self-referential opener in frame swap.

third_party/WebKit/Source/web/tests/WebFrameTest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 7599 matching lines @@
     popupLocalFrame->initializeToReplaceRemoteFrame(popupRemoteFrame, "", WebSandboxFlags::None);
     popupRemoteFrame->swap(popupLocalFrame);
 
     // The initial document created during the remote-to-local swap should have
     // inherited its opener's SecurityOrigin.
     EXPECT_TRUE(mainFrame->securityOrigin().canAccess(popupView->mainFrame()->securityOrigin()));
 
     popupView->close();
 }
 
+TEST_F(WebFrameTest, SwapWithOpenerCycle)
+{
+    // First, create a remote main frame with itself as the opener.
+    FrameTestHelpers::TestWebViewClient viewClient;
+    WebView* view = WebView::create(&viewClient);
+    FrameTestHelpers::TestWebRemoteFrameClient remoteClient;
+    WebRemoteFrame* remoteFrame = remoteClient.frame();
+    view->setMainFrame(remoteFrame);
+    remoteFrame->setOpener(remoteFrame);
+
+    // Now swap in a local frame. It shouldn't crash.
+    FrameTestHelpers::TestWebFrameClient localClient;
+    WebLocalFrame* localFrame = WebLocalFrame::create(WebTreeScopeType::Document, &localClient);
+    localFrame->initializeToReplaceRemoteFrame(remoteFrame, "", WebSandboxFlags::None);
+    remoteFrame->swap(localFrame);
+
+    // And the opener cycle should still be preserved.
+    EXPECT_EQ(localFrame, localFrame->opener());
+
+    view->close();
+}
+
 class CommitTypeWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     explicit CommitTypeWebFrameClient()
         : m_historyCommitType(WebHistoryInertCommit)
     {
     }
 
     void didCommitProvisionalLoad(WebLocalFrame*, const WebHistoryItem&, WebHistoryCommitType historyCommitType) override
     {
         m_historyCommitType = historyCommitType;
@@ skipping 646 matching lines @@
     EXPECT_TRUE(resource);
     EXPECT_NE(0, resource->loadFinishTime());
 
     DocumentLoader* loader = document->loader();
 
     EXPECT_TRUE(loader);
     EXPECT_EQ(loader->timing().responseEnd(), resource->loadFinishTime());
 }
 
 } // namespace blink