| Index: third_party/WebKit/Source/core/frame/LocalFrame.cpp
|
| diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.cpp b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
|
| index 9d4064262a3aae427d5fd76f81870857786f393a..55f39465a8c59abdcd96ac7fa5425a804aad10e8 100644
|
| --- a/third_party/WebKit/Source/core/frame/LocalFrame.cpp
|
| +++ b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
|
| @@ -320,6 +320,14 @@ void LocalFrame::detach(FrameDetachType type)
|
| // detached, so protect a reference to it.
|
| RefPtrWillBeRawPtr<LocalFrame> protect(this);
|
| m_loader.stopAllLoaders();
|
| + // Don't allow any new child frames to load in this frame: attaching a new
|
| + // child frame during or after detaching children results in an attached
|
| + // frame on a detached DOM tree, which is bad.
|
| + // TODO(dcheng): Strictly speaking, this only needs to be scoped immediately
|
| + // before detachChildren(). However, this was previously scoped to the
|
| + // unload event as well. Investigate if it's possible to move it after
|
| + // dispatchUnloadEvent(), and if it makes sense to do that.
|
| + SubframeLoadingDisabler disabler(*document());
|
| m_loader.dispatchUnloadEvent();
|
| detachChildren();
|
| m_frameScheduler.clear();
|
|
|