Call LocalDOMWindow::clearDocument when a frame gets detached

third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 457 matching lines @@
 
 MediaQueryList* LocalDOMWindow::matchMedia(const String& media) {
   return document() ? document()->mediaQueryMatcher().matchMedia(media)
                     : nullptr;
 }
 
 void LocalDOMWindow::frameDestroyed() {
   for (const auto& domWindowProperty : m_properties)
     domWindowProperty->frameDestroyed();
 
+  clearDocument();
   resetLocation();
   m_properties.clear();
   removeAllEventListeners();
   m_frame = nullptr;
 }
 
 void LocalDOMWindow::registerProperty(DOMWindowProperty* property) {
   m_properties.add(property);
 }
 
@@ skipping 1075 matching lines @@
 
 LocalFrame* LocalDOMWindow::frame() const {
   // If the LocalDOMWindow still has a frame reference, that frame must point
   // back to this LocalDOMWindow: otherwise, it's easy to get into a situation
   // where script execution leaks between different LocalDOMWindows.
   SECURITY_DCHECK(!m_frame || m_frame->domWindow() == this);
   return m_frame;
 }
 
 }  // namespace blink