Refactor frame navigation/detach state cleanup to be more sane.

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 224 matching lines @@
 void FrameLoader::clear()
 {
     // clear() is called during (Local)Frame detachment or when
     // reusing a FrameLoader by putting a new Document within it
     // (DocumentLoader::ensureWriter().)
     if (m_stateMachine.creatingInitialEmptyDocument())
         return;
 
     m_frame->editor().clear();
     m_frame->document()->cancelParsing();
-    m_frame->document()->prepareForDestruction();
     m_frame->document()->removeFocusedElementOfSubtree(m_frame->document());
     m_frame->selection().prepareForDestruction();
     m_frame->eventHandler().clear();
     if (m_frame->view())
         m_frame->view()->clear();
 
     m_frame->script().enableEval();
 
     m_frame->navigationScheduler().cancel();
 
@@ skipping 16 matching lines @@
     RefPtr<DocumentLoader> documentLoader(m_frame->document()->loader());
 
     UseCounter::count(*m_frame->document(), UseCounter::ReplaceDocumentViaJavaScriptURL);
 
     // Prepare a DocumentInit before clearing the frame, because it may need to
     // inherit an aliased security context.
     DocumentInit init(m_frame->document()->url(), m_frame);
     init.withNewRegistrationContext();
 
     stopAllLoaders();
+    m_frame->detachChildren();
+    m_frame->document()->prepareForDestruction();
     clear();
 
-    // clear() potentially detaches the frame from the document. The
+    // detachChildren() potentially detaches the frame from the document. The
     // loading cannot continue in that case.
     if (!m_frame->page())
         return;
 
     documentLoader->replaceDocumentWhileExecutingJavaScriptURL(init, source, ownerDocument);
 }
 
 void FrameLoader::setHistoryItemStateForCommit(HistoryCommitType historyCommitType, bool isPushOrReplaceState, PassRefPtr<SerializedScriptValue> stateObject)
 {
     if (m_provisionalItem)
@@ skipping 662 matching lines @@
     }
 
     // The call to dispatchUnloadEvent() can execute arbitrary JavaScript.
     // If the script initiates a new load, we need to abandon the current load,
     // or the two will stomp each other.
     // detachChildren will similarly trigger child frame unload event handlers.
     if (m_documentLoader) {
         client()->dispatchWillClose();
         dispatchUnloadEvent();
     }
-    m_frame->detachChildren();
+    if (m_frame->document()) {
+        m_frame->detachChildren();

[Nate Chapin, 2015/04/03 20:42:32]

It's clear to me why detachChildren() is a noop if m_frame->document() is null,
but it might(?) be more clear if this is outside the if().

[dcheng, 2015/04/03 20:47:20]

The idea is if there's no document, there should be no children to detach either
(because it wouldn't be possible to attach them to the DOM/active Document yet).
That being said, your comment below makes sense (and I added a brief comment
here as well).

+        m_frame->document()->prepareForDestruction();
+    } else {
+        // If there is no document, this is the creation of the initial empty
+        // doc, and there should be no child frames.
+        ASSERT(m_frame->tree().childCount() == 0);

[Nate Chapin, 2015/04/03 20:42:32]

Maybe drop this else{} clause and ASSERT this unconditionally? It should always
be true at this point.

[dcheng, 2015/04/03 20:47:20]

Done.

+    }
     if (pdl != m_provisionalDocumentLoader)
         return;
     if (m_documentLoader)
         m_documentLoader->detachFromFrame();
     m_documentLoader = m_provisionalDocumentLoader.release();
 
     if (isLoadingMainFrame())
         m_frame->page()->chrome().client().needTouchEvents(false);
 
     client()->transitionToCommittedForNewPage();
@@ skipping 449 matching lines @@
     // FIXME: We need a way to propagate insecure requests policy flags to
     // out-of-process frames. For now, we'll always use default behavior.
     if (!parentFrame->isLocalFrame())
         return nullptr;
 
     ASSERT(toLocalFrame(parentFrame)->document());
     return toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
 }
 
 } // namespace blink