| Index: third_party/WebKit/Source/core/frame/LocalFrame.cpp
|
| diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.cpp b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
|
| index 9d4064262a3aae427d5fd76f81870857786f393a..a21ee55cefeae63b41c8150b868fae84149c5f24 100644
|
| --- a/third_party/WebKit/Source/core/frame/LocalFrame.cpp
|
| +++ b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
|
| @@ -320,6 +320,10 @@ void LocalFrame::detach(FrameDetachType type)
|
| // detached, so protect a reference to it.
|
| RefPtrWillBeRawPtr<LocalFrame> protect(this);
|
| m_loader.stopAllLoaders();
|
| + // Don't allow any new child frames to load in this frame: attaching a new
|
| + // child frame during or after detaching children results in an attached
|
| + // frame on a detached DOM tree, which is bad.
|
| + SubframeLoadingDisabler disabler(*document());
|
| m_loader.dispatchUnloadEvent();
|
| detachChildren();
|
| m_frameScheduler.clear();
|
|
|