Don't reset LoadEventProgress if frame unload has already started.

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index a6fe87a40f7c79897252a8137154d9adbfcb923e..638b62719866072ccf8a8f6fd3dbe9c9f473bb82 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -2476,7 +2476,10 @@ void Document::open()
 
     if (m_frame)
         m_frame->loader().didExplicitOpen();
-    if (m_loadEventProgress != LoadEventInProgress && pageDismissalEventBeingDispatched() == NoDismissal)
+    // TODO(dcheng): According to the spec, document.open() during frame detach
+    // should be completely ignored. Add a UMA to measure how often this
+    // happens, and whether or not we can change this behavior to match spec.
+    if (m_loadEventProgress != LoadEventInProgress && !unloadStarted() && !processingBeforeUnload())
         m_loadEventProgress = LoadEventNotRun;
 }
 
@@ -2769,8 +2772,10 @@ void Document::dispatchUnloadEvents()
     if (m_parser)
         m_parser->stopParsing();
 
-    if (m_loadEventProgress == LoadEventNotRun)
+    if (m_loadEventProgress == LoadEventNotRun) {
+        m_loadEventProgress = UnloadEventHandled;

[dcheng, 2016/02/03 03:13:29]

This was the original fix proposed in the bug. I believe it is insufficient.

1. Page starts XHR that never completes.
2. Navigation starts.
3. Provisional navigation prepares to commit.
4. Unload handlers run. At this point, m_loadEventProgres == UnloadEventHandled.
5. Now XHR abort handlers run.
6. XHR abort handler calls document.open(), which resets m_loadEventProgress to
LoadEventNotRun.
7. Now, XHR abort handler can attach a child frame during frame detach again.

         return;
+    }
 
     if (m_loadEventProgress <= UnloadEventInProgress) {
         Element* currentFocusedElement = focusedElement();