Always use FrameNavigationDisabler during DocumentLoader detach.

third_party/WebKit/Source/core/loader/FrameLoader.cpp

Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 98043161ced3d6f7e13f09d89c9b864899bb2490..4f8c4d0a9cb3e3ed7f94be0bad612c82b8b0cdd3 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -725,6 +725,7 @@ void FrameLoader::detachDocumentLoader(Member<DocumentLoader>& loader)
     if (!loader)
         return;
 
+    FrameNavigationDisabler navigationDisabler(*m_frame);
     loader->detachFromFrame();
     loader = nullptr;
 }
@@ -1113,7 +1114,6 @@ bool FrameLoader::prepareForCommit()
     // At this point, the provisional document loader should not detach, because
     // then the FrameLoader would not have any attached DocumentLoaders.
     if (m_documentLoader) {

[dcheng, 2016/06/17 20:03:45]

Unrelated nit: I wonder if we should just remove this if () while we're at it to
be consistent?

(I guess we have to keep the braces for TemporaryChange)

-        FrameNavigationDisabler navigationDisabler(*m_frame);
         TemporaryChange<bool> inDetachDocumentLoader(m_protectProvisionalLoader, true);
         detachDocumentLoader(m_documentLoader);
     }
@@ -1420,10 +1420,7 @@ void FrameLoader::startLoad(FrameLoadRequest& frameLoadRequest, FrameLoadType ty
         return;
 
     m_frame->document()->cancelParsing();
-    if (m_provisionalDocumentLoader) {
-        FrameNavigationDisabler navigationDisabler(*m_frame);
-        detachDocumentLoader(m_provisionalDocumentLoader);
-    }
+    detachDocumentLoader(m_provisionalDocumentLoader);
 
     // beforeunload fired above, and detaching a DocumentLoader can fire
     // events, which can detach this frame.