In bug 31446 comment 7, Darin asks if WebFrameImpl::loadData call to setReplacing could that interact in an interesting way with this code. Turns out he was right! This is causing an assert to trigger with the code added in r53143 because we're trying to replace a document that already exists. Fix coming up.
Created attachment 46413 [details] Patch
Comment on attachment 46413 [details] Patch I think this is ok, but I'm not 100% sure.
Comment on attachment 46413 [details] Patch Clearing flags on attachment: 46413 Committed r53171: <http://trac.webkit.org/changeset/53171>
All reviewed patches have been landed. Closing bug.