Gracefully handle a self-referential opener in frame swap.

third_party/WebKit/Source/web/OpenedFrameTracker.cpp

Index: third_party/WebKit/Source/web/OpenedFrameTracker.cpp
diff --git a/third_party/WebKit/Source/web/OpenedFrameTracker.cpp b/third_party/WebKit/Source/web/OpenedFrameTracker.cpp
index bd0181391b5d3058672a7cb313c2cc45e90f8d1b..9d2540be8aa672ad34cd67f6eb0ce4519e6bd631 100644
--- a/third_party/WebKit/Source/web/OpenedFrameTracker.cpp
+++ b/third_party/WebKit/Source/web/OpenedFrameTracker.cpp
@@ -18,7 +18,7 @@ OpenedFrameTracker::~OpenedFrameTracker()
 {
 #if !ENABLE(OILPAN)
     // Oilpan takes care of clearing weak m_opener fields during GC.
-    updateOpener(0);
+    transferTo(nullptr);
 #endif
 }
 
@@ -37,11 +37,12 @@ void OpenedFrameTracker::remove(WebFrame* frame)
     m_openedFrames.remove(frame);
 }
 
-void OpenedFrameTracker::updateOpener(WebFrame* frame)
+void OpenedFrameTracker::transferTo(WebFrame* opener)
 {
-    HashSet<WebFrame*>::iterator end = m_openedFrames.end();
-    for (HashSet<WebFrame*>::iterator it = m_openedFrames.begin(); it != end; ++it)
-        (*it)->m_opener = frame;
+    // Copy the set of opened frames, since changing the owner will mutate this set.
+    HashSet<WebFrame*> frames(m_openedFrames);
+    for (WebFrame* frame : frames)
+        frame->setOpener(opener);
 }
 
 template <typename VisitorDispatcher>