Disallow script execution after unload event dispatch in frame detach.

Source/core/frame/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 83 matching lines @@
 void Frame::trace(Visitor* visitor)
 {
     visitor->trace(m_treeNode);
     visitor->trace(m_host);
     visitor->trace(m_owner);
     visitor->trace(m_domWindow);
 }
 
 void Frame::detach()
 {
-    // client() should never be null because that means we somehow re-entered
-    // the frame detach code... but it is sometimes.
-    // FIXME: Understand why this is happening so we can document this insanity.
-    // http://crbug.com/371084 is a probable explanation.
-    if (!client())
-        return;
+    ASSERT(m_client);
     disconnectOwnerElement();
     // After this, we must no longer talk to the client since this clears
     // its owning reference back to our owning LocalFrame.
     m_client->detached();
     m_client = nullptr;
     m_host = nullptr;
 }
 
 void Frame::detachChildren()
 {
@@ skipping 101 matching lines @@
     }
     m_owner = nullptr;
 }
 
 HTMLFrameOwnerElement* Frame::deprecatedLocalOwner() const
 {
     return m_owner && m_owner->isLocal() ? toHTMLFrameOwnerElement(m_owner) : 0;
 }
 
 } // namespace blink