Fixes crash in HTMLIFrameElement and exposes HTMLIFrameElement::src

sky/engine/core/html/HTMLIFrameElement.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sky/engine/config.h"
 #include "sky/engine/core/html/HTMLIFrameElement.h"
 
 #include "gen/sky/core/HTMLNames.h"
 #include "mojo/edk/js/handle.h"
 #include "sky/engine/core/frame/LocalFrame.h"
@@ skipping 17 matching lines @@
 HTMLIFrameElement::~HTMLIFrameElement()
 {
     if (m_contentView)
         m_contentView->RemoveObserver(this);
 }
 
 void HTMLIFrameElement::insertedInto(ContainerNode* insertionPoint)
 {
     HTMLElement::insertedInto(insertionPoint);
     if (insertionPoint->inDocument()) {
-        if (LocalFrame* frame = document().frame())
+        if (LocalFrame* frame = document().frame()) {
             m_contentView = frame->loaderClient()->createChildFrame();
+            m_contentView->AddObserver(this);
+        }
         navigateView();
     }
 }
 
 void HTMLIFrameElement::removedFrom(ContainerNode* insertionPoint)
 {
     HTMLElement::removedFrom(insertionPoint);
     if (m_contentView)
         m_contentView->Destroy();
 }
@@ skipping 38 matching lines @@
         urlString = blankURL().string();
 
     KURL url = document().completeURL(urlString);
 
     mojo::MessagePipe exposedServicesPipe;
     m_exposedServices = exposedServicesPipe.handle0.Pass();
 
     m_contentView->Embed(mojo::String::From(url.string().utf8().data()),
         mojo::GetProxy(&m_services),
         mojo::MakeProxy<mojo::ServiceProvider>(exposedServicesPipe.handle1.Pass()));
-    m_contentView->AddObserver(this);
 }
 
 }