Make sure the Document is always detached before it's too late.

During a navigation, FrameLoader::clear() typically detaches the
Document before DocumentLoader::createWriterFor() replaces the
DOMWindow and cancels all pending navigations.

However, synchronous navigations during a pagehide event can cause
FrameLoader::clear() to be re-entered, causing it to skip the detach.
This wasn't a problem before r151960, since the Frame::setDocument()
call would detach the Document if it was still attached.

Now, we manually check if the original Document is still attached
before replacing the DOMWindow. If it's still attached, then we
detach it anyway. As a bonus, this fix revealed an older bug where
AXObjectCache's timer can fire for destroyed Documents. To fix that,
FrameLoader::clear() uses prepareForDestruction() instead of detach().

BUG=261836, 268642

Review URL: https://chromiumcodereview.appspot.com/21109008

git-svn-id: svn://svn.chromium.org/blink/trunk@156496 bbb929c8-8fbe-4397-9dbb-9b2b20218538