Fix crash when popstate handler detaches frame during history navigation

LayoutTests/fast/loader/stateobjects/resources/pushstate-in-iframe-child.html

 <script>
 onunload = function() {
   // disable page cache
 }
 
+var pageLoaded = false;
+
 onpopstate = function() {
+  // The first time popstate fires, it's because the page has finished loading.
+  if (!pageLoaded) {
+    pageLoaded = true;
+    return;
+  }
+
   var topWin = top;
   // Verify that we are still in an iframe
   if (topWin == window) {
     topWin.document.body.innerHTML = "FAIL";
   } else {
     topWin.document.body.innerHTML = "PASS";
   }
   if (topWin.testRunner)
     topWin.testRunner.notifyDone();
 }
 
 onload = function() {
   history.pushState(null, null);
   history.pushState(null, null);
   setTimeout(function() { history.back() }, 0);
 }
 </script>