Don't stop the documentLoader on navigations.

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 1270 matching lines @@
         m_policyDocumentLoader->setOverrideEncoding(m_documentLoader->overrideEncoding());
 
     // stopAllLoaders can detach the LocalFrame, so protect it.
     RefPtr<LocalFrame> protect(m_frame);
     if ((!m_policyDocumentLoader->shouldContinueForNavigationPolicy(request) || !shouldClose()) && m_policyDocumentLoader) {
         m_policyDocumentLoader->detachFromFrame();
         m_policyDocumentLoader = nullptr;
         return;
     }
 
-    // A new navigation is in progress, so don't clear the history's provisional item.
-    stopAllLoaders();
-
-    // <rdar://problem/6250856> - In certain circumstances on pages with multiple frames, stopAllLoaders()
-    // might detach the current FrameLoader, in which case we should bail on this newly defunct load.
-    if (!m_frame->page() || !m_policyDocumentLoader)

[Nate Chapin, 2014/05/20 17:47:09]

I don't think that removing this early return is safe.
DocumentLoader::stopLoading() doesn't do as much work as
FrameLoader::stopAllLoaders(), but I think if this is an iframe it can still
call into FrameLoader::checkCompleted(), which can call the parent's
checkCompleted(), which can fire the parent's load event and do work to trigger
the cases in this if().

[mkosiba (inactive), 2014/05/20 19:06:10]

I will leave the check in. If I wanted to hit this scenario manually what would
be a good test case? An iframe that navigates the parent?

Also, when you fiddle with it, how do you test the code? I ended up running
browser_tests and content_browsertests but those are incredibly slooow.

[Nate Chapin, 2014/05/20 19:16:06]

In terms of repro, I have never actually seen a reliable repro for either of
those cases. The m_frame->page() check has existed from time immemorial, and the
m_policyDocumentLoader check was in response to a top crasher I couldn't repro,
but fixed based on crash stacks. :(

In terms of testing, I usually run layout tests and webkit_unit_tests locally,
then send try jobs for everything else, and approximate "good enough to request
review" when the trybots have passed at least one bot.

-        return;
+    if (m_provisionalDocumentLoader) {
+        m_provisionalDocumentLoader->stopLoading();
+        if (m_provisionalDocumentLoader)
+            m_provisionalDocumentLoader->detachFromFrame();
+        m_provisionalDocumentLoader = nullptr;
+    }
+    m_checkTimer.stop();
 
     if (isLoadingMainFrame())
         m_frame->page()->inspectorController().resume();
     m_frame->navigationScheduler().cancel();
 
     m_provisionalDocumentLoader = m_policyDocumentLoader.release();
     m_loadType = type;
     m_state = FrameStateProvisional;
 
     if (formState)
         m_client->dispatchWillSubmitForm(formState->form());
 
     m_progressTracker->progressStarted();
+

[Nate Chapin, 2014/05/20 17:47:09]

Any reason for the extra newlines here and below?

[mkosiba (inactive), 2014/05/20 19:06:10]

Done.

     if (m_provisionalDocumentLoader->isClientRedirect())
         m_provisionalDocumentLoader->appendRedirect(m_frame->document()->url());
     m_provisionalDocumentLoader->appendRedirect(m_provisionalDocumentLoader->request().url());
     m_client->dispatchDidStartProvisionalLoad();
     ASSERT(m_provisionalDocumentLoader);
     m_provisionalDocumentLoader->startLoadingMainResource();
+
 }
 
 void FrameLoader::applyUserAgent(ResourceRequest& request)
 {
     String userAgent = this->userAgent(request.url());
     ASSERT(!userAgent.isNull());
     request.setHTTPUserAgent(AtomicString(userAgent));
 }
 
 bool FrameLoader::shouldInterruptLoadForXFrameOptions(const String& content, const KURL& url, unsigned long requestIdentifier)
@@ skipping 109 matching lines @@
 {
     SandboxFlags flags = m_forcedSandboxFlags;
     if (LocalFrame* parentFrame = m_frame->tree().parent())
         flags |= parentFrame->document()->sandboxFlags();
     if (HTMLFrameOwnerElement* ownerElement = m_frame->ownerElement())
         flags |= ownerElement->sandboxFlags();
     return flags;
 }
 
 } // namespace WebCore