Gracefully handle unruly children detaching our frame and client.

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 965 matching lines @@
     if (pdl != m_provisionalDocumentLoader)
         return;
     if (m_documentLoader)
         m_documentLoader->detachFromFrame();
     m_documentLoader = m_provisionalDocumentLoader.release();
     if (m_frame->document()) {
         // Note that calling detachChildren() shouldn't be needed if there's no
         // Document, since no child frames should be attached. The assert below
         // enforces this invariant.
         m_frame->detachChildren();
+        // If detachChildren() detaches this frame, abandon the current load.
+        if (!client())
+            return;
         m_frame->document()->detach();
     }
     ASSERT(m_frame->tree().childCount() == 0);
 
     if (isLoadingMainFrame())
         m_frame->page()->chrome().client().needTouchEvents(false);
 
     client()->transitionToCommittedForNewPage();
     m_frame->navigationScheduler().cancel();
     m_frame->editor().clearLastEditCommand();
@@ skipping 455 matching lines @@
     // FIXME: We need a way to propagate insecure requests policy flags to
     // out-of-process frames. For now, we'll always use default behavior.
     if (!parentFrame->isLocalFrame())
         return nullptr;
 
     ASSERT(toLocalFrame(parentFrame)->document());
     return toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
 }
 
 } // namespace blink