Fix crash when popstate handler detaches frame during history navigation

LayoutTests/fast/loader/stateobjects/resources/pushstate-in-iframe-child.html

Index: LayoutTests/fast/loader/stateobjects/resources/pushstate-in-iframe-child.html
diff --git a/LayoutTests/fast/loader/stateobjects/resources/pushstate-in-iframe-child.html b/LayoutTests/fast/loader/stateobjects/resources/pushstate-in-iframe-child.html
index 517ed73b0289c61cd041c632fe54d7cff2b8812a..b5c68129304632ab4740cf09e7f026f66280db29 100644
--- a/LayoutTests/fast/loader/stateobjects/resources/pushstate-in-iframe-child.html
+++ b/LayoutTests/fast/loader/stateobjects/resources/pushstate-in-iframe-child.html
@@ -3,7 +3,15 @@ onunload = function() {
   // disable page cache
 }
 
+var pageLoaded = false;
+
 onpopstate = function() {
+  // The first time popstate fires, it's because the page has finished loading.
+  if (!pageLoaded) {
+    pageLoaded = true;
+    return;
+  }
+
   var topWin = top;
   // Verify that we are still in an iframe
   if (topWin == window) {