Assert that we never insert an frame element that already has a frame

third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp

Index: third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp b/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
index d1e42eb9aad4ce904481e85729876682cac745d1..2eb31fc900331db981aa4680b02a1ff43c109c35 100644
--- a/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
@@ -180,6 +180,10 @@ void HTMLFrameElementBase::didNotifySubtreeInsertionsToDocument() {
   if (!SubframeLoadingDisabler::canLoadFrame(*this))
     return;
 
+  // We should never have a content frame at the point where we got inserted
+  // into a tree.
+  SECURITY_CHECK(!contentFrame());
+
   setNameAndOpenURL();
 }