Gracefully handle unruly children detaching our frame and client.

Source/core/loader/FrameLoader.cpp

Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index 5d17ba671aa3458daf719ad25a587e7f1377e09b..4044537b0b04a26af9b6d6126537356aed142457 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -983,6 +983,9 @@ void FrameLoader::commitProvisionalLoad()
         // Document, since no child frames should be attached. The assert below
         // enforces this invariant.
         m_frame->detachChildren();
+        // If detachChildren() detaches this frame, abandon the current load.
+        if (!client())
+            return;
         m_frame->document()->detach();
     }
     ASSERT(m_frame->tree().childCount() == 0);