Ensure that removing an iframe from the DOM tree disconnects its Frame.

Ensure that removing an iframe from the DOM tree disconnects its Frame.
<https://webkit.org/b/128889>
<rdar://problem/15671221>

Merged from Blink (patch by Adam Klein):
https://src.chromium.org/viewvc/blink?revision=156174&view=revision

Source/WebCore:

SubframeLoadingDisabler wasn't catching the case when an <iframe> was,
in its unload handler, removed and re-added to the same parent.
Fix this by using a count of SubframeLoadingDisablers that are on the
stack for a given root, rather than a simple boolean.

Test: fast/frames/reattach-in-unload.html

* html/HTMLFrameOwnerElement.h:
(WebCore::SubframeLoadingDisabler::disabledSubtreeRoots):

LayoutTests:

* fast/frames/reattach-in-unload-expected.txt: Added.
* fast/frames/reattach-in-unload.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@164204 268f45cc-cd09-0410-ab3c-d52691b4dbfc