Track connected subframes per-Document instead of per-Node.

third_party/WebKit/Source/core/dom/ContainerNode.cpp

Index: third_party/WebKit/Source/core/dom/ContainerNode.cpp
diff --git a/third_party/WebKit/Source/core/dom/ContainerNode.cpp b/third_party/WebKit/Source/core/dom/ContainerNode.cpp
index 94afd0d3c4ca367c9483673e4a661b3384b42275..15e15bb7613f4305a97d3ac52b942c351a4da4a3 100644
--- a/third_party/WebKit/Source/core/dom/ContainerNode.cpp
+++ b/third_party/WebKit/Source/core/dom/ContainerNode.cpp
@@ -23,7 +23,6 @@
 #include "core/dom/ContainerNode.h"
 
 #include "bindings/core/v8/ExceptionState.h"
-#include "core/dom/ChildFrameDisconnector.h"
 #include "core/dom/ChildListMutationScope.h"
 #include "core/dom/ClassCollection.h"
 #include "core/dom/ElementTraversal.h"
@@ -78,7 +77,6 @@ static void collectChildrenAndRemoveFromOldParent(Node& node, NodeVector& nodes,
 #if !ENABLE(OILPAN)
 void ContainerNode::removeDetachedChildren()
 {
-    ASSERT(!connectedSubframeCount());
     ASSERT(needsAttach());
     removeDetachedChildrenInContainer(*this);
 }
@@ -327,7 +325,7 @@ void ContainerNode::parserInsertBefore(PassRefPtrWillBeRawPtr<Node> newChild, No
 
         treeScope().adoptIfNeeded(*newChild);
         insertBeforeCommon(nextChild, *newChild);
-        newChild->updateAncestorConnectedSubframeCountForInsertion();
+        ASSERT(!document().subframeTracker().hasConnectedSubframes(*newChild));
         ChildListMutationScope(*this).childAdded(*newChild);
     }
 
@@ -438,7 +436,8 @@ void ContainerNode::willRemoveChild(Node& child)
     ChildListMutationScope(*this).willRemoveChild(child);
     child.notifyMutationObserversNodeWillDetach();
     dispatchChildRemovalEvents(child);
-    ChildFrameDisconnector(child).disconnect();
+    // TODO(dcheng): Is it possible for document() to be null here?
+    document().subframeTracker().disconnectSubframesAt(child);
     if (document() != child.document()) {
         // |child| was moved another document by DOM mutation event handler.
         return;
@@ -467,7 +466,8 @@ void ContainerNode::willRemoveChildren()
         dispatchChildRemovalEvents(child);
     }
 
-    ChildFrameDisconnector(*this).disconnect(ChildFrameDisconnector::DescendantsOnly);
+    // TODO(dcheng): Is it possible for document() to be null here?
+    document().subframeTracker().disconnectSubframesAt(*this, SubframeTracker::DescendantsOnly);
 }
 
 #if !ENABLE(OILPAN)
@@ -632,8 +632,7 @@ void ContainerNode::parserRemoveChild(Node& oldChild)
     ASSERT(!oldChild.isDocumentFragment());
 
     // This may cause arbitrary Javascript execution via onunload handlers.
-    if (oldChild.connectedSubframeCount())
-        ChildFrameDisconnector(oldChild).disconnect();
+    document().subframeTracker().disconnectSubframesAt(*this);
 
     if (oldChild.parentNode() != this)
         return;
@@ -807,7 +806,7 @@ void ContainerNode::parserAppendChild(PassRefPtrWillBeRawPtr<Node> newChild)
 
         treeScope().adoptIfNeeded(*newChild);
         appendChildCommon(*newChild);
-        newChild->updateAncestorConnectedSubframeCountForInsertion();
+        ASSERT(!document().subframeTracker().hasConnectedSubframes(*newChild));
         ChildListMutationScope(*this).childAdded(*newChild);
     }