FrameTree::Find only searches relative to local frames.

third_party/WebKit/Source/core/page/FrameTree.cpp

Index: third_party/WebKit/Source/core/page/FrameTree.cpp
diff --git a/third_party/WebKit/Source/core/page/FrameTree.cpp b/third_party/WebKit/Source/core/page/FrameTree.cpp
index 9480da093754bb8bf1b0bd857573f8a1d615c4a1..ea7c652ccce64d866aab51213ee5e1270efed022 100644
--- a/third_party/WebKit/Source/core/page/FrameTree.cpp
+++ b/third_party/WebKit/Source/core/page/FrameTree.cpp
@@ -155,6 +155,9 @@ unsigned FrameTree::ChildCount() const {
 }
 
 Frame* FrameTree::Find(const AtomicString& name) const {
+  // Named frame lookup should always be relative to a local frame.
+  DCHECK(this_frame_->IsLocalFrame());
+
   if (EqualIgnoringASCIICase(name, "_self") ||
       EqualIgnoringASCIICase(name, "_current") || name.IsEmpty())
     return this_frame_;