Sprinkle some release asserts over HTMLFrameElementBase

third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp

Index: third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp b/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
index 2e3534b3059a5c1ef8a0e9dec3e630f2c3b1859a..566a9cb9b6a65e356cd67d5d46c9ce83ed18c4d5 100644
--- a/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
@@ -47,6 +47,7 @@ HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Documen
     , m_scrollingMode(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
+    , m_javaScriptURLFailedAccessCheck(false)
 {
 }
 
@@ -58,8 +59,11 @@ bool HTMLFrameElementBase::isURLAllowed() const
     const KURL& completeURL = document().completeURL(m_URL);
 
     if (protocolIsJavaScript(completeURL)) {
-        if (contentFrame() && !ScriptController::canAccessFromCurrentOrigin(toIsolate(&document()), contentFrame()))
+        if (contentFrame() && !ScriptController::canAccessFromCurrentOrigin(toIsolate(&document()), contentFrame())) {
+            m_javaScriptURLFailedAccessCheck = true;
             return false;
+        }
+        SECURITY_CHECK(!m_javaScriptURLFailedAccessCheck);
     }
 
     LocalFrame* parentFrame = document().frame();
@@ -166,6 +170,10 @@ void HTMLFrameElementBase::didNotifySubtreeInsertionsToDocument()
     if (!SubframeLoadingDisabler::canLoadFrame(*this))
         return;
 
+    // We should never have a content frame at the point where we got inserted
+    // into a tree.
+    SECURITY_CHECK(!contentFrame());
+
     setNameAndOpenURL();
 }
 
@@ -186,6 +194,7 @@ void HTMLFrameElementBase::attachLayoutTree(const AttachContext& context)
 void HTMLFrameElementBase::setLocation(const String& str)
 {
     m_URL = AtomicString(str);
+    m_javaScriptURLFailedAccessCheck = false;
 
     if (isConnected())
         openURL(false);