Add a SECURITY_CHECK that HTMLFrameElementBase is a consistent state.

third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 20 matching lines @@
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/RemoteFrame.h"
 #include "core/frame/RemoteFrameView.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "core/page/FocusController.h"
 #include "core/page/Page.h"
+#include "wtf/Assertions.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName,
                                            Document& document)
     : HTMLFrameOwnerElement(tagName, document),
       m_scrollingMode(ScrollbarAuto),
       m_marginWidth(-1),
@@ skipping 129 matching lines @@
   return InsertionShouldCallDidNotifySubtreeInsertions;
 }
 
 void HTMLFrameElementBase::didNotifySubtreeInsertionsToDocument() {
   if (!document().frame())
     return;
 
   if (!SubframeLoadingDisabler::canLoadFrame(*this))
     return;
 
+  // If there's a content frame already attached, the DOM is already in an
+  // inconsistent state. It's dangerous to continue, so just abort.
+  SECURITY_CHECK(!contentFrame());
+
   setNameAndOpenURL();
 }
 
 void HTMLFrameElementBase::attachLayoutTree(const AttachContext& context) {
   HTMLFrameOwnerElement::attachLayoutTree(context);
 
   if (layoutPart()) {
     if (Frame* frame = contentFrame()) {
       if (frame->isLocalFrame())
         setWidget(toLocalFrame(frame)->view());
@@ skipping 61 matching lines @@
   m_marginWidth = marginWidth;
   frameOwnerPropertiesChanged();
 }
 
 void HTMLFrameElementBase::setMarginHeight(int marginHeight) {
   m_marginHeight = marginHeight;
   frameOwnerPropertiesChanged();
 }
 
 }  // namespace blink