Heap-use-after-free in DocumentLoader::stopLoading
https://bugs.webkit.org/show_bug.cgi?id=103656

Reviewed by Eric Seidel.

Source/WebCore:

Test: fast/dom/ready-state-change-crash.html

* html/parser/HTMLDocumentParser.cpp:
(WebCore::HTMLDocumentParser::prepareToStopParsing): Bail out
if the parser is detached due to mutation event.
* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::stopLoading): Move the protectors for
frame and document loader to the start of the function. Call to
m_frame->loader()->stopLoading() can change document ready state
and fire mutation event which might blow the document loader from
underneath.

LayoutTests:

* fast/dom/ready-state-change-crash-expected.txt: Added.
* fast/dom/ready-state-change-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138926 268f45cc-cd09-0410-ab3c-d52691b4dbfc