Refactor frame navigation/detach state cleanup to be more sane.

Source/core/loader/FrameLoader.cpp

Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index 922fb8214a549fff262e326be04cf7f61258e42b..1fa96613bb515abf95ae473bcaec6fbe85b45194 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -242,7 +242,6 @@ void FrameLoader::clear()
 
     m_frame->editor().clear();
     m_frame->document()->cancelParsing();
-    m_frame->document()->prepareForDestruction();
     m_frame->document()->removeFocusedElementOfSubtree(m_frame->document());
     m_frame->selection().prepareForDestruction();
     m_frame->eventHandler().clear();
@@ -279,13 +278,16 @@ void FrameLoader::replaceDocumentWhileExecutingJavaScriptURL(const String& sourc
     init.withNewRegistrationContext();
 
     stopAllLoaders();
-    clear();
+    m_frame->detachChildren();
 
-    // clear() potentially detaches the frame from the document. The
+    // detachChildren() potentially detaches the frame from the document. The
     // loading cannot continue in that case.
     if (!m_frame->page())
         return;
 
+    m_frame->document()->prepareForDestruction();
+    clear();

[dcheng, 2015/04/03 14:35:45]

Consistency!

+
     documentLoader->replaceDocumentWhileExecutingJavaScriptURL(init, source, ownerDocument);
 }
 
@@ -970,6 +972,8 @@ void FrameLoader::commitProvisionalLoad()
     if (m_documentLoader)
         m_documentLoader->detachFromFrame();
     m_documentLoader = m_provisionalDocumentLoader.release();
+    if (m_frame->document())

[dcheng, 2015/04/03 14:35:45]

Similarly, this has to handle the null case due to creating the initial empty
doc.

+        m_frame->document()->prepareForDestruction();
 
     if (isLoadingMainFrame())
         m_frame->page()->chrome().client().needTouchEvents(false);