Allow navigations to frames that aren't being unloaded in the unload handler.

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 269 matching lines @@
   m_currentItem->setVisualViewportScrollOffset(toScrollOffset(
       m_frame->host()->visualViewport().visibleRect().location()));
 
   if (m_frame->isMainFrame())
     m_currentItem->setPageScaleFactor(m_frame->page()->pageScaleFactor());
 
   client()->didUpdateCurrentHistoryItem();
 }
 
 void FrameLoader::dispatchUnloadEvent() {
-  NavigationDisablerForUnload navigationDisabler;
+  FrameNavigationDisabler navigationDisabler(*m_frame);
 
   // If the frame is unloading, the provisional loader should no longer be
   // protected. It will be detached soon.
   m_protectProvisionalLoader = false;
   saveScrollState();
 
   if (m_frame->document() && !SVGImage::isInSVGImage(m_frame->document()))
     m_frame->document()->dispatchUnloadEvents();
 }
 
@@ skipping 779 matching lines @@
   }
   return policy;
 }
 
 void FrameLoader::load(const FrameLoadRequest& passedRequest,
                        FrameLoadType frameLoadType,
                        HistoryItem* historyItem,
                        HistoryLoadType historyLoadType) {
   DCHECK(m_frame->document());
 
-  if (!m_frame->isNavigationAllowed())
+  if (isBackForwardLoadType(frameLoadType) && !m_frame->isNavigationAllowed())
     return;
 
   if (m_inStopAllLoaders)
     return;
 
   if (m_frame->page()->suspended() && isBackForwardLoadType(frameLoadType)) {
     m_deferredHistoryLoad = DeferredHistoryLoad::create(
         passedRequest.resourceRequest(), historyItem, frameLoadType,
         historyLoadType);
     return;
@@ skipping 10 matching lines @@
     DCHECK(historyItem);
     m_provisionalItem = historyItem;
   }
 
   // Form submissions appear to need their special-case of finding the target at
   // schedule rather than at fire.
   Frame* targetFrame = request.form()
                            ? nullptr
                            : m_frame->findFrameForNavigation(
                                  AtomicString(request.frameName()), *m_frame);
+
   NavigationPolicy policy = navigationPolicyForRequest(request);
   if (targetFrame && targetFrame != m_frame &&
       shouldNavigateTargetFrame(policy)) {
+    if (targetFrame->isLocalFrame() &&
+        !toLocalFrame(targetFrame)->isNavigationAllowed()) {
+      return;
+    }
+
     bool wasInSamePage = targetFrame->page() == m_frame->page();
 
     request.setFrameName("_self");
     targetFrame->navigate(request);
     Page* page = targetFrame->page();
     if (!wasInSamePage && page)
       page->chromeClient().focus();
     return;
   }
 
   setReferrerForFrameRequest(request);
 
   if (!targetFrame && !request.frameName().isEmpty()) {
     if (policy == NavigationPolicyDownload) {
       client()->loadURLExternally(request.resourceRequest(),
                                   NavigationPolicyDownload, String(), false);
     } else {
       request.resourceRequest().setFrameType(WebURLRequest::FrameTypeAuxiliary);
       createWindowForRequest(request, *m_frame, policy);
     }
     return;
   }
 
+  if (!m_frame->isNavigationAllowed())
+    return;
+
   const KURL& url = request.resourceRequest().url();
   FrameLoadType newLoadType = (frameLoadType == FrameLoadTypeStandard)
                                   ? determineFrameLoadType(request)
                                   : frameLoadType;
   bool sameDocumentHistoryNavigation =
       isBackForwardLoadType(newLoadType) &&
       historyLoadType == HistorySameDocumentLoad;
   bool sameDocumentNavigation =
       policy == NavigationPolicyCurrentTab &&
       shouldPerformFragmentNavigation(request.form(),
@@ skipping 389 matching lines @@
   for (Frame* child = m_frame->tree().firstChild(); child;
        child = child->tree().traverseNext(m_frame)) {
     // FIXME: There is not yet any way to dispatch events to out-of-process
     // frames.
     if (child->isLocalFrame())
       targetFrames.append(toLocalFrame(child));
   }
 
   bool shouldClose = false;
   {
-    NavigationDisablerForUnload navigationDisabler;
+    NavigationDisablerForBeforeUnload navigationDisabler;
     size_t i;
 
     bool didAllowNavigation = false;
     for (i = 0; i < targetFrames.size(); i++) {
       if (!targetFrames[i]->tree().isDescendantOf(m_frame))
         continue;
       if (!targetFrames[i]->document()->dispatchBeforeUnloadEvent(
               page->chromeClient(), isReload, didAllowNavigation))
         break;
     }
@@ skipping 384 matching lines @@
                          m_documentLoader ? m_documentLoader->url() : String());
   return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const {
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this,
                                       toTracedValue());
 }
 
 }  // namespace blink