Keep frames to navigate alive in HistoryController::goToEntry()

Source/core/loader/FrameLoader.cpp

Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index 06bbce3a01c3016cfc61bb863ccc570c8d8bead5..2a9a2ebde74734805bd245b46a1e3d7c4bfee22b 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -1405,11 +1405,12 @@ Frame* FrameLoader::findFrameForNavigation(const AtomicString& name, Document* a
 
 void FrameLoader::loadHistoryItem(HistoryItem* item, HistoryLoadType historyLoadType, ResourceRequestCachePolicy cachePolicy)
 {
+    // The frame may have been detached by a pageshow/popstate event handler.
+    if (!m_client)
+        return;
+
     m_provisionalItem = item;
     if (historyLoadType == HistorySameDocumentLoad) {
-        // loadInSameDocument() might (indirectly) dispatch events, which could lead to the frame being
-        // detached, so protect it.
-        RefPtr<Frame> protect(m_frame);
         loadInSameDocument(item->url(), item->stateObject(), DoNotUpdateBackForwardList, NotClientRedirect);
         restoreScrollPositionAndViewState(ForcedRestoreForSameDocumentHistoryNavigation);
         return;