diff --git a/LayoutTests/fast/dom/HTMLBodyElement/body-inserting-iframe-crash-expected.txt b/LayoutTests/fast/dom/HTMLBodyElement/body-inserting-iframe-crash-expected.txt
new file mode 100644
index 00000000000..fbfeed92c6e
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLBodyElement/body-inserting-iframe-crash-expected.txt
@@ -0,0 +1 @@
+PASS if not crashed.
diff --git a/LayoutTests/fast/dom/HTMLBodyElement/body-inserting-iframe-crash.html b/LayoutTests/fast/dom/HTMLBodyElement/body-inserting-iframe-crash.html
new file mode 100644
index 00000000000..35cece8d531
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLBodyElement/body-inserting-iframe-crash.html
@@ -0,0 +1,25 @@
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+var iframe = null;
+
+function start() {
+    iframe = document.createElement('iframe');
+    iframe.setAttribute('marginwidth', 1);
+    document.body.appendChild(iframe);
+
+    var bodyInFrame = document.createElement('body');
+    bodyInFrame.addEventListener('DOMSubtreeModified', removeIframe);
+    iframe.contentDocument.documentElement.appendChild(bodyInFrame);
+    document.body.innerHTML = 'PASS if not crashed.';
+}
+
+function removeIframe() {
+    iframe.parentNode.removeChild(iframe);
+    iframe = null;
+    gc();
+}
+</script>
+<body onload="start()">
+</body>
diff --git a/Source/core/html/HTMLBodyElement.cpp b/Source/core/html/HTMLBodyElement.cpp
index 17a8b8edd18..f7e7f72afe3 100644
--- a/Source/core/html/HTMLBodyElement.cpp
+++ b/Source/core/html/HTMLBodyElement.cpp
@@ -155,22 +155,24 @@ void HTMLBodyElement::parseAttribute(const QualifiedName& name, const AtomicStri
 Node::InsertionNotificationRequest HTMLBodyElement::insertedInto(ContainerNode* insertionPoint)
 {
     HTMLElement::insertedInto(insertionPoint);
-    if (insertionPoint->inDocument()) {
-        // FIXME: It's surprising this is web compatible since it means a marginwidth
-        // and marginheight attribute can magically appear on the <body> of all documents
-        // embedded through <iframe> or <frame>.
-        Element* ownerElement = document().ownerElement();
-        if (isHTMLFrameElementBase(ownerElement)) {
-            HTMLFrameElementBase& ownerFrameElement = toHTMLFrameElementBase(*ownerElement);
-            int marginWidth = ownerFrameElement.marginWidth();
-            if (marginWidth != -1)
-                setIntegralAttribute(marginwidthAttr, marginWidth);
-            int marginHeight = ownerFrameElement.marginHeight();
-            if (marginHeight != -1)
-                setIntegralAttribute(marginheightAttr, marginHeight);
-        }
-    }
-    return InsertionDone;
+    return InsertionShouldCallDidNotifySubtreeInsertions;
+}
+
+void HTMLBodyElement::didNotifySubtreeInsertionsToDocument()
+{
+    // FIXME: It's surprising this is web compatible since it means a
+    // marginwidth and marginheight attribute can magically appear on the <body>
+    // of all documents embedded through <iframe> or <frame>.
+    Element* ownerElement = document().ownerElement();
+    if (!isHTMLFrameElementBase(ownerElement))
+        return;
+    HTMLFrameElementBase& ownerFrameElement = toHTMLFrameElementBase(*ownerElement);
+    int marginWidth = ownerFrameElement.marginWidth();
+    int marginHeight = ownerFrameElement.marginHeight();
+    if (marginWidth != -1)
+        setIntegralAttribute(marginwidthAttr, marginWidth);
+    if (marginHeight != -1)
+        setIntegralAttribute(marginheightAttr, marginHeight);
 }
 
 bool HTMLBodyElement::isURLAttribute(const Attribute& attribute) const
diff --git a/Source/core/html/HTMLBodyElement.h b/Source/core/html/HTMLBodyElement.h
index 6794c7e2bcd..fc7bb47abc8 100644
--- a/Source/core/html/HTMLBodyElement.h
+++ b/Source/core/html/HTMLBodyElement.h
@@ -51,6 +51,7 @@ class HTMLBodyElement FINAL : public HTMLElement {
     virtual void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) OVERRIDE;
 
     virtual InsertionNotificationRequest insertedInto(ContainerNode*) OVERRIDE;
+    virtual void didNotifySubtreeInsertionsToDocument() OVERRIDE;
 
     virtual bool isURLAttribute(const Attribute&) const OVERRIDE;
     virtual bool hasLegalLinkAttribute(const QualifiedName&) const OVERRIDE;
