Index: third_party/WebKit/Source/core/frame/LocalFrame.cpp |
diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.cpp b/third_party/WebKit/Source/core/frame/LocalFrame.cpp |
index 9d4064262a3aae427d5fd76f81870857786f393a..a21ee55cefeae63b41c8150b868fae84149c5f24 100644 |
--- a/third_party/WebKit/Source/core/frame/LocalFrame.cpp |
+++ b/third_party/WebKit/Source/core/frame/LocalFrame.cpp |
@@ -320,6 +320,10 @@ void LocalFrame::detach(FrameDetachType type) |
// detached, so protect a reference to it. |
RefPtrWillBeRawPtr<LocalFrame> protect(this); |
m_loader.stopAllLoaders(); |
+ // Don't allow any new child frames to load in this frame: attaching a new |
+ // child frame during or after detaching children results in an attached |
+ // frame on a detached DOM tree, which is bad. |
+ SubframeLoadingDisabler disabler(*document()); |
m_loader.dispatchUnloadEvent(); |
detachChildren(); |
m_frameScheduler.clear(); |