Assert that we never insert an frame element that already has a frame

third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 162 matching lines @@
   return InsertionShouldCallDidNotifySubtreeInsertions;
 }
 
 void HTMLFrameElementBase::didNotifySubtreeInsertionsToDocument() {
   if (!document().frame())
     return;
 
   if (!SubframeLoadingDisabler::canLoadFrame(*this))
     return;
 
+  // We should never have a content frame at the point where we got inserted
+  // into a tree.
+  SECURITY_CHECK(!contentFrame());
+
   setNameAndOpenURL();
 }
 
 void HTMLFrameElementBase::attachLayoutTree(const AttachContext& context) {
   HTMLFrameOwnerElement::attachLayoutTree(context);
 
   if (layoutPart()) {
     if (Frame* frame = contentFrame()) {
       if (frame->isLocalFrame())
         setWidget(toLocalFrame(frame)->view());
@@ skipping 82 matching lines @@
 
   if (contentDocument()) {
     contentDocument()->willChangeFrameOwnerProperties(
         m_marginWidth, marginHeight, m_scrollingMode);
   }
   m_marginHeight = marginHeight;
   frameOwnerPropertiesChanged();
 }
 
 }  // namespace blink