Index: third_party/WebKit/Source/core/frame/LocalFrame.cpp |
diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.cpp b/third_party/WebKit/Source/core/frame/LocalFrame.cpp |
index 9d4064262a3aae427d5fd76f81870857786f393a..55f39465a8c59abdcd96ac7fa5425a804aad10e8 100644 |
--- a/third_party/WebKit/Source/core/frame/LocalFrame.cpp |
+++ b/third_party/WebKit/Source/core/frame/LocalFrame.cpp |
@@ -320,6 +320,14 @@ void LocalFrame::detach(FrameDetachType type) |
// detached, so protect a reference to it. |
RefPtrWillBeRawPtr<LocalFrame> protect(this); |
m_loader.stopAllLoaders(); |
+ // Don't allow any new child frames to load in this frame: attaching a new |
+ // child frame during or after detaching children results in an attached |
+ // frame on a detached DOM tree, which is bad. |
+ // TODO(dcheng): Strictly speaking, this only needs to be scoped immediately |
+ // before detachChildren(). However, this was previously scoped to the |
+ // unload event as well. Investigate if it's possible to move it after |
+ // dispatchUnloadEvent(), and if it makes sense to do that. |
+ SubframeLoadingDisabler disabler(*document()); |
m_loader.dispatchUnloadEvent(); |
detachChildren(); |
m_frameScheduler.clear(); |