Disallow script execution after unload event dispatch in frame detach.

Source/core/frame/RemoteFrame.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/RemoteFrame.h"
 
 #include "core/frame/RemoteFrameClient.h"
 #include "core/frame/RemoteFrameView.h"
 #include "core/html/HTMLFrameOwnerElement.h"
@@ skipping 22 matching lines @@
     // correct referrer, since it won't have access to the originDocument. Set it now.
     ResourceRequest request(url);
     Referrer referrer(SecurityPolicy::generateReferrerHeader(originDocument.referrerPolicy(), url, originDocument.outgoingReferrer()), originDocument.referrerPolicy());
     request.setHTTPReferrer(referrer);
     remoteFrameClient()->navigate(request, lockBackForwardList);
 }
 
 void RemoteFrame::detach()
 {
     detachChildren();
+    if (!client())

[dcheng, 2014/10/16 01:21:32]

I'm not sure if this condition is ever true at the moment, but I don't see a
reason why this might not happen in the future (the same thing that can cause
Blink to try to detach the same LocalFrame multiple times should also be able to
do the same for RemoteFrames).

+        return;
     Frame::detach();
 }
 
 void RemoteFrame::trace(Visitor* visitor)
 {
     visitor->trace(m_view);
     Frame::trace(visitor);
 }
 
 void RemoteFrame::setView(PassRefPtrWillBeRawPtr<RemoteFrameView> view)
@@ skipping 14 matching lines @@
         owner->setWidget(view);
     }
 }
 
 RemoteFrameClient* RemoteFrame::remoteFrameClient() const
 {
     return static_cast<RemoteFrameClient*>(client());
 }
 
 } // namespace blink