Add a counter and a deprecation message when navigating in an unload handler.

third_party/WebKit/Source/core/loader/NavigationScheduler.cpp

Index: third_party/WebKit/Source/core/loader/NavigationScheduler.cpp
diff --git a/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp b/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp
index ccb0ab41139fe53b31ea4c5cfdef5c7c3d488b1e..fc33be20a265afe052061b68a86ff360dcb074e8 100644
--- a/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp
+++ b/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp
@@ -34,6 +34,7 @@
 #include "bindings/core/v8/ScriptController.h"
 #include "core/events/Event.h"
 #include "core/fetch/ResourceLoaderOptions.h"
+#include "core/frame/Deprecation.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/html/HTMLFormElement.h"
@@ -56,6 +57,7 @@
 namespace blink {
 
 unsigned NavigationDisablerForBeforeUnload::s_navigationDisableCount = 0;
+unsigned NavigationCounterForUnload::s_inUnloadHandler = 0;
 
 class ScheduledNavigation : public GarbageCollectedFinalized<ScheduledNavigation> {
     WTF_MAKE_NONCOPYABLE(ScheduledNavigation);
@@ -347,6 +349,9 @@ void NavigationScheduler::scheduleLocationChange(Document* originDocument, const
     if (originDocument->getSecurityOrigin()->canAccess(m_frame->document()->getSecurityOrigin())) {
         KURL parsedURL(ParsedURLString, url);
         if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(m_frame->document()->url(), parsedURL)) {
+            if (NavigationCounterForUnload::inUnloadHandler())
+                Deprecation::countDeprecation(m_frame, UseCounter::UnloadHandler_Navigation);

[Nate Chapin, 2016/05/13 21:56:10]

This will only catch same-document navigations (i.e., the ones that can actually
complete synchronously inside of an unload handler). I assume that is
intentional? If so, do you also want to catch history pushState/replaceState?

[lfg, 2016/05/14 01:23:28]

Right, the other navigations are already blocked (see my other comment).

From my understanding looking at the spec, pushState/replaceState should be
allowed even in the unload handler, but I'll defer to your knowledge here.

[Nate Chapin, 2016/05/16 21:00:31]

I agree that it's permitted by the spec, but it wasn't clear to me whether we
might consider a spec change to forbid it. I don't feel strongly about adding
logging for it, I just wanted to make sure that it wasn't being omitted
unintentionally.

[lfg, 2016/05/16 23:46:54]

Right, this one is working as intended :)

+
             FrameLoadRequest request(originDocument, m_frame->document()->completeURL(url), "_self");
             request.setReplacesCurrentItem(replacesCurrentItem);
             if (replacesCurrentItem)