Avoid mutating frame owner when detaching a provisional frame.

third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h

 /*
  * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 26 matching lines @@
 class LayoutPart;
 class Widget;
 
 class CORE_EXPORT HTMLFrameOwnerElement : public HTMLElement,
                                           public FrameOwner {
   USING_GARBAGE_COLLECTED_MIXIN(HTMLFrameOwnerElement);
 
  public:
   ~HTMLFrameOwnerElement() override;
 
-  Frame* contentFrame() const { return m_contentFrame; }
   DOMWindow* contentWindow() const;
   Document* contentDocument() const;
 
   virtual void disconnectContentFrame();
 
   // Most subclasses use LayoutPart (either LayoutEmbeddedObject or
   // LayoutIFrame) except for HTMLObjectElement and HTMLEmbedElement which may
   // return any LayoutObject when using fallback content.
   LayoutPart* layoutPart() const;
 
@@ skipping 11 matching lines @@
 
    public:
     UpdateSuspendScope();
     ~UpdateSuspendScope();
 
    private:
     void performDeferredWidgetTreeOperations();
   };
 
   // FrameOwner overrides:
-  void setContentFrame(Frame&) override;
-  void clearContentFrame() override;
-  void dispatchLoad() override;
-  SandboxFlags getSandboxFlags() const override { return m_sandboxFlags; }
+  Frame* contentFrame() const final { return m_contentFrame; }
+  void setContentFrame(Frame&) final;
+  void clearContentFrame() final;
+  void dispatchLoad() final;
+  SandboxFlags getSandboxFlags() const final { return m_sandboxFlags; }
   bool canRenderFallbackContent() const override { return false; }
   void renderFallbackContent() override {}
   ScrollbarMode scrollingMode() const override { return ScrollbarAuto; }
   int marginWidth() const override { return -1; }
   int marginHeight() const override { return -1; }
   bool allowFullscreen() const override { return false; }
   bool allowPaymentRequest() const override { return false; }
   AtomicString csp() const override { return nullAtom; }
   const WebVector<WebPermissionType>& delegatedPermissions() const override;
 
   DECLARE_VIRTUAL_TRACE();
 
  protected:
   HTMLFrameOwnerElement(const QualifiedName& tagName, Document&);
   void setSandboxFlags(SandboxFlags);
 
   bool loadOrRedirectSubframe(const KURL&,
                               const AtomicString& frameName,
                               bool replaceCurrentItem);
   bool isKeyboardFocusable() const override;
 
   void disposeWidgetSoon(Widget*);
 
  private:
   // Intentionally private to prevent redundant checks when the type is
   // already HTMLFrameOwnerElement.
-  bool isLocal() const override { return true; }
-  bool isRemote() const override { return false; }
+  bool isLocal() const final { return true; }
+  bool isRemote() const final { return false; }
 
   bool isFrameOwnerElement() const final { return true; }
 
   virtual ReferrerPolicy referrerPolicyAttribute() {
     return ReferrerPolicyDefault;
   }
 
   Member<Frame> m_contentFrame;
   Member<Widget> m_widget;
   SandboxFlags m_sandboxFlags;
@@ skipping 36 matching lines @@
 
 DEFINE_TYPE_CASTS(HTMLFrameOwnerElement,
                   FrameOwner,
                   owner,
                   owner->isLocal(),
                   owner.isLocal());
 
 }  // namespace blink
 
 #endif  // HTMLFrameOwnerElement_h