Fix use-after-free when creating and detaching iframe during load.

Source/web/WebLocalFrameImpl.h

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 295 matching lines @@
     // Returns the text finder object if it already exists.
     // Otherwise creates it and then returns.
     TextFinder& ensureTextFinder();
 
     // Invalidates vertical scrollbar only.
     void invalidateScrollbar() const;
 
     // Invalidates both content area and the scrollbar.
     void invalidateAll() const;
 
-    void initializeAsChildFrame(WebCore::FrameHost*, WebCore::FrameOwner*, const AtomicString& name, const AtomicString& fallbackName);
+    PassRefPtr<WebCore::LocalFrame> initializeAsChildFrame(WebCore::FrameHost*, WebCore::FrameOwner*, const AtomicString& name, const AtomicString& fallbackName);
 
 private:
     friend class FrameLoaderClientImpl;
 
     explicit WebLocalFrameImpl(WebFrameClient*);
 
     // Sets the local WebCore frame and registers destruction observers.
     void setWebCoreFrame(PassRefPtr<WebCore::LocalFrame>);
 
     void loadJavaScriptURL(const WebCore::KURL&);
@@ skipping 32 matching lines @@
     UserMediaClientImpl m_userMediaClientImpl;
 
     OwnPtr<GeolocationClientProxy> m_geolocationClientProxy;
 };
 
 DEFINE_TYPE_CASTS(WebLocalFrameImpl, WebFrame, frame, frame->isWebLocalFrame(), frame.isWebLocalFrame());
 
 } // namespace blink
 
 #endif