Detach all subframes before swapping a frame.

Source/web/WebFrame.cpp

Index: Source/web/WebFrame.cpp
diff --git a/Source/web/WebFrame.cpp b/Source/web/WebFrame.cpp
index b6832d30b735811ea7c4940a581f6364b0182073..1795cd6fd6f9ec7fda91f5e96a7ee004455a34bc 100644
--- a/Source/web/WebFrame.cpp
+++ b/Source/web/WebFrame.cpp
@@ -25,12 +25,19 @@ Frame* toCoreFrame(const WebFrame* frame)
         : toWebRemoteFrameImpl(frame)->frame();
 }
 
-void WebFrame::swap(WebFrame* frame)
+bool WebFrame::swap(WebFrame* frame)
 {
     using std::swap;
+    RefPtr<Frame> oldFrame = toCoreFrame(this);
+
+    // All child frames must be detached first.
+    oldFrame->detachChildren();
+
+    // If the frame has been detached during detaching its children, return
+    // immediately.
+    if (!oldFrame->host())
+        return false;
 
-    // All child frames must have been detached first.
-    ASSERT(!m_firstChild && !m_lastChild);
     // The frame being swapped in should not have a Frame associated
     // with it yet.
     ASSERT(!toCoreFrame(frame));
@@ -66,7 +73,6 @@ void WebFrame::swap(WebFrame* frame)
     // the type of the passed in WebFrame.
     // FIXME: This is a bit clunky; this results in pointless decrements and
     // increments of connected subframes.
-    Frame* oldFrame = toCoreFrame(this);
     FrameOwner* owner = oldFrame->owner();
     oldFrame->disconnectOwnerElement();
     if (frame->isWebLocalFrame()) {
@@ -74,6 +80,8 @@ void WebFrame::swap(WebFrame* frame)
     } else {
         toWebRemoteFrameImpl(frame)->initializeCoreFrame(oldFrame->host(), owner, oldFrame->tree().name());
     }
+
+    return true;
 }
 
 v8::Handle<v8::Value> WebFrame::executeScriptAndReturnValueForTests(const WebScriptSource& source)