Code: void FrameLoader::StopAllLoaders() {
  if (frame_->GetDocument()->PageDismissalEventBeingDispatched() !=
      Document::kNoDismissal)
    return;

   if (in_stop_all_loaders_)
     return;
 
  in_stop_all_loaders_ = true;
 
   for (Frame* child = frame_->Tree().FirstChild(); child;
        child = child->Tree().NextSibling()) {
    if (child->IsLocalFrame())
      ToLocalFrame(child)->Loader().StopAllLoaders();
  }
 
   frame_->GetDocument()->CancelParsing();
   if (document_loader_)
    document_loader_->Fetcher()->StopFetching();
   if (!protect_provisional_loader_)
     DetachDocumentLoader(provisional_document_loader_);
   frame_->GetNavigationScheduler().Cancel();
  if (document_loader_ && !document_loader_->SentDidFinishLoad()) {
    document_loader_->LoadFailed(
        ResourceError::CancelledError(document_loader_->Url()));
  }
  in_stop_all_loaders_ = false;
 
   TakeObjectSnapshot();
 }

Vulnerability Type: DoS Mem. Corr. 
CWE ID: CWE-362
Summary: The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.
Commit Message: Fix detach with open()ed document leaving parent loading indefinitely

Change-Id: I26c2a054b9f1e5eb076acd677e1223058825f6d6

Bug: 803416
Test: fast/loader/document-open-iframe-then-detach.html
Change-Id: I26c2a054b9f1e5eb076acd677e1223058825f6d6
Reviewed-on: https://chromium-review.googlesource.com/887298
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#532967}