Refactor frame navigation/detach state cleanup to be more sane.

Source/core/dom/Document.cpp

Index: Source/core/dom/Document.cpp
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
index 646a36b53a65645d7d145b0ce1565c7bb7008fb3..b0bbc14bc491cdf3ba2b2bb18d73f08c6015db48 100644
--- a/Source/core/dom/Document.cpp
+++ b/Source/core/dom/Document.cpp
@@ -2161,13 +2161,14 @@ void Document::detach(const AttachContext& context)
 
 void Document::prepareForDestruction()
 {
-    m_markers->prepareForDestruction();
-    disconnectDescendantFrames();
+    ASSERT(!m_frame || m_frame->tree().childCount() == 0);
 
-    // The process of disconnecting descendant frames could have already detached us.
     if (!isActive())
         return;
 
+    ScriptForbiddenScope forbidScript;
+
+    m_markers->prepareForDestruction();
     if (LocalDOMWindow* window = this->domWindow())
         window->willDetachDocumentFromFrame();
     detach();