Disallow script execution after unload event dispatch in frame detach.

Source/core/frame/RemoteFrame.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/RemoteFrame.h"
 
 #include "core/frame/RemoteFrameClient.h"
 #include "core/frame/RemoteFrameView.h"
 #include "core/html/HTMLFrameOwnerElement.h"
@@ skipping 21 matching lines @@
     // The process where this frame actually lives won't have sufficient information to determine
     // correct referrer, since it won't have access to the originDocument. Set it now.
     ResourceRequest request(url);
     request.setHTTPReferrer(SecurityPolicy::generateReferrer(originDocument.referrerPolicy(), url, originDocument.outgoingReferrer()));
     remoteFrameClient()->navigate(request, lockBackForwardList);
 }
 
 void RemoteFrame::detach()
 {
     detachChildren();
+    if (!client())
+        return;
     Frame::detach();
 }
 
 void RemoteFrame::forwardInputEvent(Event* event)
 {
     remoteFrameClient()->forwardInputEvent(event);
 }
 
 void RemoteFrame::trace(Visitor* visitor)
 {
@@ skipping 19 matching lines @@
         owner->setWidget(view);
     }
 }
 
 RemoteFrameClient* RemoteFrame::remoteFrameClient() const
 {
     return static_cast<RemoteFrameClient*>(client());
 }
 
 } // namespace blink