Refactor frame navigation/detach state cleanup to be more sane.

Source/core/xml/XSLTProcessor.cpp

 /*
  * This file is part of the XSL implementation.
  *
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple, Inc. All rights reserved.
  * Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 58 matching lines @@
 
     RefPtrWillBeRawPtr<Document> result = nullptr;
     DocumentInit init(sourceIsDocument ? ownerDocument->url() : KURL(), frame);
 
     bool forceXHTML = sourceMIMEType == "text/plain";
     if (forceXHTML)
         transformTextStringToXHTMLDocumentString(documentSource);
 
     if (frame) {
         RefPtrWillBeRawPtr<Document> oldDocument = frame->document();
+        oldDocument->detach();
         result = frame->localDOMWindow()->installNewDocument(sourceMIMEType, init, forceXHTML);
 
         // Before parsing, we need to save & detach the old document and get the new document
         // in place. We have to do this only if we're rendering the result document.
         if (FrameView* view = frame->view())
             view->clear();
 
         if (oldDocument) {
             DocumentXSLT::from(*result).setTransformSourceDocument(oldDocument.get());
             result->updateSecurityOrigin(oldDocument->securityOrigin());
@@ skipping 68 matching lines @@
 }
 
 DEFINE_TRACE(XSLTProcessor)
 {
     visitor->trace(m_stylesheet);
     visitor->trace(m_stylesheetRootNode);
     visitor->trace(m_document);
 }
 
 } // namespace blink