Merge 72863 - Crash when iframe transfers from one page to another and has ch...

WebCore/page/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 716 matching lines @@
 
         m_page = newPage;
 
         if (newPage)
             newPage->incrementFrameCount();
 
         didTransfer = true;
     }
 
     // Update the frame tree.
-    didTransfer = newParent->tree()->transferChild(this);
+    didTransfer = newParent->tree()->transferChild(this) || didTransfer;
 
     // Avoid unnecessary calls to client and frame subtree if the frame ended
     // up on the same page and under the same parent frame.
     if (didTransfer) {
         // Let external clients update themselves.
         loader()->client()->didTransferChildFrameToNewDocument(oldPage);
 
         // Update resource tracking now that frame could be in a different page.
         if (oldPage != newPage)
             loader()->transferLoadingResourcesFromPage(oldPage);
@@ skipping 227 matching lines @@
     document->recalcStyle(Node::Force);
 
     if (FrameView* view = this->view()) {
         if (document->renderer() && document->renderer()->needsLayout() && view->didFirstLayout())
             view->layout();
         view->setScrollPosition(origin);
     }
 }
 
 } // namespace WebCore