Fix for crash when attaching a frame in WebUI renderer.

content/browser/web_contents/web_contents_impl_browsertest.cc

Index: content/browser/web_contents/web_contents_impl_browsertest.cc
diff --git a/content/browser/web_contents/web_contents_impl_browsertest.cc b/content/browser/web_contents/web_contents_impl_browsertest.cc
index f3441a240dfa7402c5653c69d6248a2d401db58e..5159281dcb0fbab868aff6df80741f836ce482e0 100644
--- a/content/browser/web_contents/web_contents_impl_browsertest.cc
+++ b/content/browser/web_contents/web_contents_impl_browsertest.cc
@@ -363,6 +363,19 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, OpenURLSubframe) {
                 controller->GetPendingEntry())->frame_tree_node_id());
 }
 
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       AppendingFrameInWebUIDoesNotCrash) {
+  const GURL kWebUIUrl("chrome://tracing");
+  const char kJSCodeForAppendingFrame[] =
+      "document.body.appendChild(document.createElement('iframe'));";
+
+  NavigateToURL(shell(), kWebUIUrl);
+
+  bool js_executed = content::ExecuteScript(shell()->web_contents(),
+                                            kJSCodeForAppendingFrame);
+  EXPECT_TRUE(js_executed);
+}
+
 // Observer class to track the creation of RenderFrameHost objects. It is used
 // in subsequent tests.
 class RenderFrameCreatedObserver : public WebContentsObserver {