Detach all subframes before swapping a frame.

Source/web/WebFrame.cpp

Index: Source/web/WebFrame.cpp
diff --git a/Source/web/WebFrame.cpp b/Source/web/WebFrame.cpp
index b6832d30b735811ea7c4940a581f6364b0182073..7fbdac76057e344dda465878c00fb1a4cde75209 100644
--- a/Source/web/WebFrame.cpp
+++ b/Source/web/WebFrame.cpp
@@ -25,12 +25,21 @@ Frame* toCoreFrame(const WebFrame* frame)
         : toWebRemoteFrameImpl(frame)->frame();
 }
 
-void WebFrame::swap(WebFrame* frame)
+bool WebFrame::swap(WebFrame* frame)
 {
     using std::swap;
+    RefPtr<Frame> oldFrame = toCoreFrame(this);
+
+    // All child frames must be detached first.
+    oldFrame->detachChildren();
+
+    // If the frame has been detached during detaching its children, return

[eseidel, 2014/09/10 18:09:12]

When does this happen?  Are there JS events which fire, etc?

+    // immediately.
+    // FIXME: There is no unit test for this condition, so one needs to be
+    // written.
+    if (!oldFrame->host())
+        return false;
 
-    // All child frames must have been detached first.
-    ASSERT(!m_firstChild && !m_lastChild);
     // The frame being swapped in should not have a Frame associated
     // with it yet.
     ASSERT(!toCoreFrame(frame));
@@ -66,7 +75,6 @@ void WebFrame::swap(WebFrame* frame)
     // the type of the passed in WebFrame.
     // FIXME: This is a bit clunky; this results in pointless decrements and
     // increments of connected subframes.
-    Frame* oldFrame = toCoreFrame(this);
     FrameOwner* owner = oldFrame->owner();
     oldFrame->disconnectOwnerElement();
     if (frame->isWebLocalFrame()) {
@@ -74,6 +82,8 @@ void WebFrame::swap(WebFrame* frame)
     } else {
         toWebRemoteFrameImpl(frame)->initializeCoreFrame(oldFrame->host(), owner, oldFrame->tree().name());
     }
+
+    return true;
 }
 
 v8::Handle<v8::Value> WebFrame::executeScriptAndReturnValueForTests(const WebScriptSource& source)