Fix crash when popstate handler detaches frame during history navigation

Protect FrameLoader::m_frame in FrameLoader::loadHistoryItem() to
keep it from being destroyed if a popstate event handler, dispatched
via FrameLoader::loadInSameDocument(), removes the frame from the
parent document.

BUG=334239

Review URL: https://codereview.chromium.org/138213002

git-svn-id: svn://svn.chromium.org/blink/trunk@165081 bbb929c8-8fbe-4397-9dbb-9b2b20218538