Cancel javascript: URL navigations if the frame was navigated.

third_party/WebKit/Source/core/loader/FrameLoader.cpp

Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 28d99d964d16b432e27c8878e60e5c31b3d20acc..00fffd55386d85ba2daa5e2498975479b1eb2e41 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -317,6 +317,7 @@ void FrameLoader::replaceDocumentWhileExecutingJavaScriptURL(const String& sourc
     // DocumentLoader::replaceDocumentWhileExecutingJavaScriptURL can cause the DocumentLoader to get deref'ed and possible destroyed,
     // so protect it with a RefPtr.
     RefPtrWillBeRawPtr<DocumentLoader> documentLoader(m_frame->document()->loader());

[haraken, 2015/11/16 08:35:59]

Nit: It would be better to move this to just above
documentLoader->replaceDocumentWhileExecutingJavaScriptURL.

+    RefPtrWillBeRawPtr<Document> originalDocument(m_frame->document());
 
     UseCounter::count(*m_frame->document(), UseCounter::ReplaceDocumentViaJavaScriptURL);
 
@@ -335,6 +336,11 @@ void FrameLoader::replaceDocumentWhileExecutingJavaScriptURL(const String& sourc
     if (!m_frame->page())
         return;
 
+    // Detaching plugins in Document::detach() can run a nested message loop, which may have
+    // resulted in loading a new, potentially cross-origin document. Cancel the JS URL navigation.
+    if (originalDocument != m_frame->document())

[dcheng, 2015/11/16 08:24:29]

I considered two other approaches:
- Checking m_frame->document()->loader() == documentLoader: this breaks
javascript: URL navigation in the initial empty document case.
- ownerDocument != m_frame->document(): this doesn't work if another Document
other than this one initiated the JS url navigation

[Nate Chapin, 2015/11/16 19:16:34]

...can we just stop the madness and disable navigation inside detach? What does
that break?

+        return;
+
     client()->transitionToCommittedForNewPage();
     documentLoader->replaceDocumentWhileExecutingJavaScriptURL(init, source, ownerDocument);
 }