Make sure FrameScheduler is cleared when LocalFrame::detach() finishes

third_party/WebKit/Source/core/frame/LocalFrame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 317 matching lines @@
     // will trigger the unload event handlers of any child frames, and those event
     // handlers might start a new subresource load in this frame.
     m_loader.stopAllLoaders();
     m_loader.detach();
     document()->detach();
     // This is the earliest that scripting can be disabled:
     // - FrameLoader::detach() can fire XHR abort events
     // - Document::detach()'s deferred widget updates can run script.
     ScriptForbiddenScope forbidScript;
     m_loader.clear();
+    // Clear FrameScheduler again in case it is recreated in scripting.
+    m_frameScheduler.reset();
     if (!client())
         return;
 
     client()->willBeDetached();
     // Notify ScriptController that the frame is closing, since its cleanup ends up calling
     // back to FrameLoaderClient via WindowProxy.
     script().clearForClose();
     setView(nullptr);
     willDetachFrameHost();
     InspectorInstrumentation::frameDetachedFromParent(this);
@@ skipping 466 matching lines @@
         m_frame->client()->frameBlameContext()->Enter();
 }
 
 ScopedFrameBlamer::~ScopedFrameBlamer()
 {
     if (m_frame && m_frame->client() && m_frame->client()->frameBlameContext())
         m_frame->client()->frameBlameContext()->Leave();
 }
 
 } // namespace blink