Detach all subframes before swapping a frame.

Source/web/WebFrame.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "public/web/WebFrame.h"
 
 #include "core/frame/RemoteFrame.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "platform/UserGestureIndicator.h"
 #include "web/OpenedFrameTracker.h"
 #include "web/WebLocalFrameImpl.h"
 #include "web/WebRemoteFrameImpl.h"
 #include <algorithm>
 
 namespace blink {
 
 Frame* toCoreFrame(const WebFrame* frame)
 {
     if (!frame)
         return 0;
 
     return frame->isWebLocalFrame()
         ? static_cast<Frame*>(toWebLocalFrameImpl(frame)->frame())
         : toWebRemoteFrameImpl(frame)->frame();
 }
 
-void WebFrame::swap(WebFrame* frame)
+bool WebFrame::swap(WebFrame* frame)
 {
     using std::swap;
+    RefPtr<Frame> oldFrame = toCoreFrame(this);
 
-    // All child frames must have been detached first.
-    ASSERT(!m_firstChild && !m_lastChild);
+    // All child frames must be detached first.
+    oldFrame->detachChildren();
+
+    // If the frame has been detached during detaching its children, return
+    // immediately.
+    if (!oldFrame->host())
+        return false;
+
     // The frame being swapped in should not have a Frame associated
     // with it yet.
     ASSERT(!toCoreFrame(frame));
 
     if (m_parent) {
         if (m_parent->m_firstChild == this)
             m_parent->m_firstChild = frame;
         if (m_parent->m_lastChild == this)
             m_parent->m_lastChild = frame;
         swap(m_parent, frame->m_parent);
@@ skipping 15 matching lines @@
     }
     if (!m_openedFrameTracker->isEmpty()) {
         m_openedFrameTracker->updateOpener(frame);
         frame->m_openedFrameTracker.reset(m_openedFrameTracker.release());
     }
 
     // Finally, clone the state of the current Frame into one matching
     // the type of the passed in WebFrame.
     // FIXME: This is a bit clunky; this results in pointless decrements and
     // increments of connected subframes.
-    Frame* oldFrame = toCoreFrame(this);
     FrameOwner* owner = oldFrame->owner();
     oldFrame->disconnectOwnerElement();
     if (frame->isWebLocalFrame()) {
         toWebLocalFrameImpl(frame)->initializeCoreFrame(oldFrame->host(), owner, oldFrame->tree().name(), nullAtom);
     } else {
         toWebRemoteFrameImpl(frame)->initializeCoreFrame(oldFrame->host(), owner, oldFrame->tree().name());
     }
+
+    return true;
 }
 
 v8::Handle<v8::Value> WebFrame::executeScriptAndReturnValueForTests(const WebScriptSource& source)
 {
     // FIXME: This fake UserGestureIndicator is required for a bunch of browser
     // tests to pass. We should update the tests to simulate input and get rid
     // of this.
     // http://code.google.com/p/chromium/issues/detail?id=86397
     UserGestureIndicator gestureIndicator(DefinitelyProcessingNewUserGesture);
     return executeScriptAndReturnValue(source);
@@ skipping 127 matching lines @@
     , m_openedFrameTracker(new OpenedFrameTracker)
 {
 }
 
 WebFrame::~WebFrame()
 {
     m_openedFrameTracker.reset(0);
 }
 
 } // namespace blink