Allow navigations to frames that aren't being unloaded in the unload handler.

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 269 matching lines @@
   m_currentItem->setVisualViewportScrollOffset(toScrollOffset(
       m_frame->host()->visualViewport().visibleRect().location()));
 
   if (m_frame->isMainFrame())
     m_currentItem->setPageScaleFactor(m_frame->page()->pageScaleFactor());
 
   client()->didUpdateCurrentHistoryItem();
 }
 
 void FrameLoader::dispatchUnloadEvent() {
-  NavigationDisablerForUnload navigationDisabler;
+  FrameNavigationDisabler navigationDisabler(*m_frame);
 
   // If the frame is unloading, the provisional loader should no longer be
   // protected. It will be detached soon.
   m_protectProvisionalLoader = false;
   saveScrollState();
 
   if (m_frame->document() && !SVGImage::isInSVGImage(m_frame->document()))
     m_frame->document()->dispatchUnloadEvents();
 }
 
@@ skipping 777 matching lines @@
   }
   return policy;
 }
 
 void FrameLoader::load(const FrameLoadRequest& passedRequest,
                        FrameLoadType frameLoadType,
                        HistoryItem* historyItem,
                        HistoryLoadType historyLoadType) {
   DCHECK(m_frame->document());
 
-  if (!m_frame->isNavigationAllowed())

[lfg, 2016/11/10 00:15:04]

This change has a side effect that javascript: navigations will be allowed if
the frame disallows navigations. I think this should be ok, since the frame is
already executing javascript anyway.

-    return;
-
   if (m_inStopAllLoaders)
     return;
 
   if (m_frame->page()->defersLoading() &&
       isBackForwardLoadType(frameLoadType)) {
     m_deferredHistoryLoad = DeferredHistoryLoad::create(
         passedRequest.resourceRequest(), historyItem, frameLoadType,
         historyLoadType);
     return;
   }
 
   FrameLoadRequest request(passedRequest);
   request.resourceRequest().setHasUserGesture(
       UserGestureIndicator::processingUserGesture());
 
   if (!prepareRequestForThisFrame(request))
     return;
 
   if (isBackForwardLoadType(frameLoadType)) {
     DCHECK(historyItem);
     m_provisionalItem = historyItem;
   }
 
   // Form submissions appear to need their special-case of finding the target at
   // schedule rather than at fire.
   Frame* targetFrame = request.form()
                            ? nullptr
                            : m_frame->findFrameForNavigation(
                                  AtomicString(request.frameName()), *m_frame);
+
+  if (targetFrame && targetFrame->isLocalFrame() &&
+      !toLocalFrame(targetFrame)->isNavigationAllowed()) {
+    return;
+  }
+
   NavigationPolicy policy = navigationPolicyForRequest(request);
   if (targetFrame && targetFrame != m_frame &&
       shouldNavigateTargetFrame(policy)) {
     bool wasInSamePage = targetFrame->page() == m_frame->page();
 
     request.setFrameName("_self");
     targetFrame->navigate(request);
     Page* page = targetFrame->page();
     if (!wasInSamePage && page)
       page->chromeClient().focus();
@@ skipping 415 matching lines @@
   for (Frame* child = m_frame->tree().firstChild(); child;
        child = child->tree().traverseNext(m_frame)) {
     // FIXME: There is not yet any way to dispatch events to out-of-process
     // frames.
     if (child->isLocalFrame())
       targetFrames.append(toLocalFrame(child));
   }
 
   bool shouldClose = false;
   {
-    NavigationDisablerForUnload navigationDisabler;
+    FrameNavigationDisabler navigationDisabler(*m_frame);
     size_t i;
 
     bool didAllowNavigation = false;
     for (i = 0; i < targetFrames.size(); i++) {
       if (!targetFrames[i]->tree().isDescendantOf(m_frame))
         continue;
       if (!targetFrames[i]->document()->dispatchBeforeUnloadEvent(
               page->chromeClient(), isReload, didAllowNavigation))
         break;
     }
@@ skipping 384 matching lines @@
                          m_documentLoader ? m_documentLoader->url() : String());
   return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const {
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this,
                                       toTracedValue());
 }
 
 }  // namespace blink