[Site Isolation] WebFrameProxy children manipulation and BFCache caching foundations

Component: WebKit Site Isolation | e16931a

Under Site Isolation, cross-site iframes are represented in the web process by RemoteFrame objects, with the UI process coordinating them via RemotePageProxy and the BrowsingContextGroup. BFCache preserves a page's entire suspended state — DOM, JS execution state, frame tree — so back/forward navigation is instant, but a page with cross-site iframes needs the UI process to orchestrate suspending and resuming those separate iframe processes, which the in-process BFCache path cannot do alone. This commit adds the plumbing: WebFrameProxy gains takeChildFrames/adoptChildFrames to detach and reattach a subframe subtree, WebBackForwardCacheEntry gains a cached-children slot with setCachedChildren/takeCachedChildren/hasCachedChildren/referencesIframeProcess, and FrameTree::hasRemoteFrameDescendant() replaces a static helper previously local to BackForwardCache.cpp. WebBackForwardCache::removeEntriesForProcess now calls referencesIframeProcess to invalidate entries whose cached subtree references a terminated iframe process.

Significance

Foundation only — the new removeEntriesForProcess check is a de facto no-op until a future patch populates m_cachedChildren, so there is no reachable behavioral change yet. The hasRemoteFrameDescendant re-home is a straightforward refactor with equivalent semantics.

Audit directions

Not yet a meaningful target: takeChildFrames/adoptChildFrames and the cached-children slot are unreachable with no populating call sites. Worth revisiting once the orchestration patch lands, because subtree detachment and reattachment with cross-process ownership transfer during BFCache suspend and restore is exactly the shape that hides use-after-free and double-reparenting bugs. In the meantime, the portable hunt is for the existing frame-tree mutation paths that will share the new APIs — audit every current caller that reparents a WebFrameProxy under process termination or provisional-navigation rollback, and ask which side holds the strong reference during the transfer. Match tell: a take/adopt pair where the interval between them can span a process-termination callback.

---