Delay calling FrameOwner::setWidget when doing a remote->local frame transition

If we call setWidget for a newly created LocalFrame that's not fully attached
to the frame tree, it will be in an inconsistent state and cause crashes during
painting. Instead, update the widget at swap-time, when the frame actually
becomes fully attached.

BUG=422583

Review URL: https://codereview.chromium.org/668963002

git-svn-id: svn://svn.chromium.org/blink/trunk@184313 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/frame/LocalFrame.cpp

@@ -183,7 +183,11 @@ void LocalFrame::createView(const IntSize& viewportSize, const Color& background
     if (ownerRenderer()) {
         HTMLFrameOwnerElement* owner = deprecatedLocalOwner();
         ASSERT(owner);
-        owner->setWidget(frameView);
+        // FIXME: OOPI might lead to us temporarily lying to a frame and telling it
+        // that it's owned by a FrameOwner that knows nothing about it. If we're
+        // lying to this frame, don't let it clobber the existing widget.
+        if (owner->contentFrame() == this)
+            owner->setWidget(frameView);
     }
 
     if (HTMLFrameOwnerElement* owner = deprecatedLocalOwner())

third_party/WebKit/Source/web/WebFrame.cpp

@@ -6,6 +6,7 @@
 #include "public/web/WebFrame.h"
 
 #include "core/frame/FrameHost.h"
+#include "core/frame/FrameView.h"
 #include "core/frame/RemoteFrame.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "platform/UserGestureIndicator.h"
@@ -75,10 +76,14 @@ bool WebFrame::swap(WebFrame* frame)
     // increments of connected subframes.
     FrameOwner* owner = oldFrame->owner();
     oldFrame->disconnectOwnerElement();
-    if (toCoreFrame(frame)) {
-        ASSERT(owner == toCoreFrame(frame)->owner());
-        if (owner->isLocal())
-            toHTMLFrameOwnerElement(owner)->setContentFrame(*toCoreFrame(frame));
+    if (Frame* newFrame = toCoreFrame(frame)) {
+        ASSERT(owner == newFrame->owner());
+        if (owner->isLocal()) {
+            HTMLFrameOwnerElement* ownerElement = toHTMLFrameOwnerElement(owner);
+            ownerElement->setContentFrame(*newFrame);
+            if (newFrame->isLocalFrame())
+                ownerElement->setWidget(toLocalFrame(newFrame)->view());
+        }
     } else if (frame->isWebLocalFrame()) {
         toWebLocalFrameImpl(frame)->initializeCoreFrame(oldFrame->host(), owner, oldFrame->tree().name(), nullAtom);
     } else {