Avoid mutating frame owner when detaching a provisional frame.

third_party/WebKit/Source/web/tests/FrameTestHelpers.cpp

Index: third_party/WebKit/Source/web/tests/FrameTestHelpers.cpp
diff --git a/third_party/WebKit/Source/web/tests/FrameTestHelpers.cpp b/third_party/WebKit/Source/web/tests/FrameTestHelpers.cpp
index a6ea70041adad867ada53855c7bfee332fde4da3..f249400ab2f9a4968bd520a645c3e66bdefeb0cc 100644
--- a/third_party/WebKit/Source/web/tests/FrameTestHelpers.cpp
+++ b/third_party/WebKit/Source/web/tests/FrameTestHelpers.cpp
@@ -289,6 +289,26 @@ void WebViewHelper::resize(WebSize size) {
 
 TestWebFrameClient::TestWebFrameClient() {}
 
+// TODO(dcheng): https://crbug.com/578349 tracks the removal of this code. This
+// override exists only to handle the confusing provisional frame case.
+void TestWebFrameClient::frameDetached(WebLocalFrame* frame, DetachType type) {
+  if (type == DetachType::Remove && frame->parent()) {
+    // Since this may be detaching a provisional frame, make sure |child| is
+    // actually linked into the frame tree (i.e. it is present in its parent
+    // node's children list) before trying to remove it as a child.
+    for (WebFrame* child = frame->parent()->firstChild(); child;
+         child = child->nextSibling()) {
+      if (child == frame)
+        frame->parent()->removeChild(frame);
+    }
+  }
+
+  if (frame->frameWidget())
+    frame->frameWidget()->close();
+
+  frame->close();
+}
+
 WebLocalFrame* TestWebFrameClient::createChildFrame(
     WebLocalFrame* parent,
     WebTreeScopeType scope,