Fix crash when popstate handler detaches frame during history navigation

Fix crash when popstate handler detaches frame during history navigation

Protect FrameLoader::m_frame in FrameLoader::loadHistoryItem() to
keep it from being destroyed if a popstate event handler, dispatched
via FrameLoader::loadInSameDocument(), removes the frame from the
parent document.

BUG=334239
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=165081

[Jens Widell, 2014-01-14 14:13:11]

Hi, please review when you have time.

This is a simple (and safe, I hope) one-line fix.  The underlying problem is
that pageshow/popstate events are dispatched synchronously during history
navigation, about which there are FIXMEs in the code.  I intend to look at
adjusting that further on.  (I think it might be fixed in Webkit already, in
fact.)

If this code change lands, I would revert the test case adjustment again in
http://code.google.com/p/chromium/issues/detail?id=334239.

[arv (Not doing code reviews), 2014-01-14 15:31:53]

LGTM

[commit-bot: I haz the power, 2014-01-14 15:55:53]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/jl@opera.com/138213002/30001

[commit-bot: I haz the power, 2014-01-14 17:14:06]

Change committed as 165081