Avoid mutating frame owner when detaching a provisional frame.

third_party/WebKit/Source/web/tests/WebFrameTest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 8711 matching lines @@
   std::string content =
       WebFrameContentDumper::dumpWebViewAsText(webView(), 1024).utf8();
   EXPECT_EQ("  \n\na\n\nb \n\na\n\nhello", content);
 
   // Manually reset to break WebViewHelper's dependency on the stack allocated
   // TestWebFrameClient.
   reset();
   remoteFrame->close();
 }
 
+TEST_F(WebFrameSwapTest, DetachProvisionalFrame) {
+  FrameTestHelpers::TestWebRemoteFrameClient remoteFrameClient;
+  WebRemoteFrameImpl* remoteFrame = WebRemoteFrameImpl::create(
+      WebTreeScopeType::Document, &remoteFrameClient);
+  swapAndVerifyMiddleChildConsistency("local->remote", mainFrame(),
+                                      remoteFrame);
+
+  FrameTestHelpers::TestWebFrameClient client;
+  WebLocalFrameImpl* provisionalFrame = WebLocalFrameImpl::createProvisional(
+      &client, remoteFrame, WebSandboxFlags::None);
+
+  // The provisional frame should have a local frame owner.
+  FrameOwner* owner = provisionalFrame->frame()->owner();
+  ASSERT_TRUE(owner->isLocal());
+
+  // But the owner should point to |remoteFrame|, since the new frame is still
+  // provisional.
+  EXPECT_EQ(remoteFrame->frame(), owner->contentFrame());
+
+  // After detaching the provisional frame, the frame owner should still point
+  // at |remoteFrame|.
+  provisionalFrame->detach();
+
+  // The owner should not be affected by detaching the provisional frame, so it
+  // should still point to |remoteFrame|.
+  EXPECT_EQ(remoteFrame->frame(), owner->contentFrame());
+
+  // Manually reset to break WebViewHelper's dependency on the stack allocated
+  // TestWebFrameClient.
+  reset();
+}
+
 void WebFrameTest::swapAndVerifySubframeConsistency(const char* const message,
                                                     WebFrame* oldFrame,
                                                     WebFrame* newFrame) {
   SCOPED_TRACE(message);
 
   EXPECT_TRUE(oldFrame->firstChild());
   oldFrame->swap(newFrame);
 
   EXPECT_FALSE(newFrame->firstChild());
   EXPECT_FALSE(newFrame->m_lastChild);
@@ skipping 2493 matching lines @@
 
   EXPECT_TRUE(mainFrameClient.childClient().didCallFrameDetached());
   EXPECT_TRUE(mainFrameClient.childClient().didCallDidStopLoading());
   EXPECT_TRUE(mainFrameClient.childClient().didCallDidFinishDocumentLoad());
   EXPECT_TRUE(mainFrameClient.childClient().didCallDidHandleOnloadEvents());
 
   webViewHelper.reset();
 }
 
 }  // namespace blink