Remove frame disconnection counter updating in removeDetachedChildren()

This method is only called from destructors or document teardown. We
apparenly also skip it when in Oilpan mode. That would seem to indicate
that by the time we get here there should be no subframes left connected.

Lets change the loop into an ASSERT to verify that.

Review URL: https://codereview.chromium.org/303653005

git-svn-id: svn://svn.chromium.org/blink/trunk@175086 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix potential crash related to loading an invalid image URL

This does not fix the clusterfuzz testcase in the bug, but I found it while
investigating that bug. See also the comment at the top of doUpdateElement.

I was unable to write a crashing testcase for this...

R=eseidel,esprehn
BUG=376748

Review URL: https://codereview.chromium.org/296343002

git-svn-id: svn://svn.chromium.org/blink/trunk@175087 bbb929c8-8fbe-4397-9dbb-9b2b20218538