Handle LocalFrame being nestedly detached by subframe.

Source/core/frame/LocalFrame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 263 matching lines @@
 
 void LocalFrame::detach(FrameDetachType type)
 {
     PluginScriptForbiddenScope forbidPluginDestructorScripting;
     // A lot of the following steps can result in the current frame being
     // detached, so protect a reference to it.
     RefPtrWillBeRawPtr<LocalFrame> protect(this);
     m_loader.stopAllLoaders();
     m_loader.dispatchUnloadEvent();
     detachChildren();
+
+    // All done if detaching the subframes brought about a detach of this frame also.
+    if (!client())
+        return;
+
     // stopAllLoaders() needs to be called after detachChildren(), because detachChildren()
     // will trigger the unload event handlers of any child frames, and those event
     // handlers might start a new subresource load in this frame.
     m_loader.stopAllLoaders();
     m_loader.detach();
     document()->detach();
     m_loader.clear();
     if (!client())

[dcheng, 2015/08/18 21:26:09]

Out of curiosity, do we still need this check with the above check? The only
thing that should be able to detach frames at this point is WebPlugin nodes
being detached in Document::detach()... but Document::detach() already blocks
scripting. So in theory... it might work without this?

(I'd be OK with deferring this to a followup patch, but I think it's worthy of
adding a comment to investigate this more)

[sof, 2015/08/19 11:44:35]

We do still need that one, added in that spot by issue 452253, as it catches
detaches that happen due to resource load cancellations. (See ps#4 bot results
for what happens if you do remove it.)

         return;
 
     client()->willBeDetached();
     // Notify ScriptController that the frame is closing, since its cleanup ends up calling
     // back to FrameLoaderClient via WindowProxy.
     script().clearForClose();
     ScriptForbiddenScope forbidScript;
     setView(nullptr);
     willDetachFrameHost();
     InspectorInstrumentation::frameDetachedFromParent(this);
@@ skipping 542 matching lines @@
 {
     if (isLocalRoot())
         m_instrumentingAgents = InstrumentingAgents::create();
     else
         m_instrumentingAgents = localFrameRoot()->m_instrumentingAgents;
 }
 
 DEFINE_WEAK_IDENTIFIER_MAP(LocalFrame);
 
 } // namespace blink