Don't reset LoadEventProgress if frame unload has already started.

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
@@ skipping 2458 matching lines @@
             m_frame->loader().stopAllLoaders();
     }
 
     removeAllEventListenersRecursively();
     implicitOpen(ForceSynchronousParsing);
     if (ScriptableDocumentParser* parser = scriptableDocumentParser())
         parser->setWasCreatedByScript(true);
 
     if (m_frame)
         m_frame->loader().didExplicitOpen();
-    if (m_loadEventProgress != LoadEventInProgress && pageDismissalEventBeingDispatched() == NoDismissal)
+    // TODO(dcheng): According to the spec, document.open() during frame detach
+    // should be completely ignored. Add a UMA to measure how often this
+    // happens, and whether or not we can change this behavior to match spec.
+    if (m_loadEventProgress != LoadEventInProgress && !unloadStarted() && !processingBeforeUnload())
         m_loadEventProgress = LoadEventNotRun;
 }
 
 void Document::detachParser()
 {
     if (!m_parser)
         return;
     m_parser->detach();
     m_parser.clear();
 }
@@ skipping 272 matching lines @@
     return false;
 }
 
 void Document::dispatchUnloadEvents()
 {
     PluginScriptForbiddenScope forbidPluginDestructorScripting;
     RefPtrWillBeRawPtr<Document> protect(this);
     if (m_parser)
         m_parser->stopParsing();
 
-    if (m_loadEventProgress == LoadEventNotRun)
+    if (m_loadEventProgress == LoadEventNotRun) {
+        m_loadEventProgress = UnloadEventHandled;

[dcheng, 2016/02/03 03:13:29]

This was the original fix proposed in the bug. I believe it is insufficient.

1. Page starts XHR that never completes.
2. Navigation starts.
3. Provisional navigation prepares to commit.
4. Unload handlers run. At this point, m_loadEventProgres == UnloadEventHandled.
5. Now XHR abort handlers run.
6. XHR abort handler calls document.open(), which resets m_loadEventProgress to
LoadEventNotRun.
7. Now, XHR abort handler can attach a child frame during frame detach again.

         return;
+    }
 
     if (m_loadEventProgress <= UnloadEventInProgress) {
         Element* currentFocusedElement = focusedElement();
         if (isHTMLInputElement(currentFocusedElement))
             toHTMLInputElement(*currentFocusedElement).endEditing();
         if (m_loadEventProgress < PageHideInProgress) {
             m_loadEventProgress = PageHideInProgress;
             if (LocalDOMWindow* window = domWindow())
                 window->dispatchEvent(PageTransitionEvent::create(EventTypeNames::pagehide, false), this);
             if (!m_frame)
@@ skipping 3166 matching lines @@
 #ifndef NDEBUG
 using namespace blink;
 void showLiveDocumentInstances()
 {
     Document::WeakDocumentSet& set = Document::liveDocumentSet();
     fprintf(stderr, "There are %u documents currently alive:\n", set.size());
     for (Document* document : set)
         fprintf(stderr, "- Document %p URL: %s\n", document, document->url().string().utf8().data());
 }
 #endif