Don't allow navigations in Document::detach.
When navigating to a javascript: URL, Blink detaches the original
Document. This process may detach plugin elements, causing a nested
message loop to run.
Document::detach() creates a ScriptForbiddenScope to prevent script from
breaking invariants. Since plugins were detached synchronously, any
script trying to execute in the nested message loop would be blocked.
However, the fix for https://crbug.com/524120 defers plugin updates to
happen outside the ScriptForbiddenScope. Thus, it is now possible to
attach a *new* Document with a synchronous navigation while the old
Document is being detached.
BUG=546545
Review URL: https://codereview.chromium.org/1444183003
Cr-Commit-Position: refs/heads/master@{#360190}
6 files changed
