Reviewed by Brady Eidson.
        
        Test for <rdar://problem/4871518> Leopard9A321: Crash visiting www.audible.com 
        (WebCore::FrameLoader::loadSubframe)
        
        Tests an onload handler for a synchronously loaded iframe removing the iframe 
        from the document.

        * fast/frames/onload-remove-iframe-crash-expected.txt: Added.
        * fast/frames/onload-remove-iframe-crash.html: Added.

WebCore:

        Reviewed by Brady Eidson.
        
        Fixed <rdar://problem/4871518> Leopard9A321: Crash visiting www.audible.com 
        (WebCore::FrameLoader::loadSubframe)

        * loader/mac/FrameLoaderMac.mm:
        (WebCore::FrameLoader::createFrame): Updated to reflect the fact that
        createChildFrameNamed: now returns a WebCore::Frame* instead of a 
        WebCoreFrameBridge *.
        * page/mac/WebCoreFrameBridge.h:

WebKit:

        Reviewed by Brady Eidson.
        
        Fixed <rdar://problem/4871518> Leopard9A321: Crash visiting www.audible.com 
        (WebCore::FrameLoader::loadSubframe)

        * WebCoreSupport/WebFrameBridge.mm:
        (-[WebFrameBridge createChildFrameNamed:withURL:referrer:ownerElement:allowsScrolling:marginWidth:marginHeight:]):
        - The fix: 
            Changed to re-fetch the child frame we're trying to load before returning it,
            since its onload handler may have removed it from the document. This
            allows us to treat a removed frame like a frame that never loaded.
        
        - Plus some cleanup:
            - Changed to return a WebCore::Frame* instead of a WebFrameBridge *,
            to simplify some code.
            - Grouped ObjC objects by usage, and moved calls to -release so that they
            immediately follow the calls that retain.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@18399 268f45cc-cd09-0410-ab3c-d52691b4dbfc