Assertion failure in WebCore::FrameLoader::stopLoading() running fast/events tests

Assertion failure in WebCore::FrameLoader::stopLoading() running fast/events tests
https://bugs.webkit.org/show_bug.cgi?id=150624
Source/WebCore:

Reviewed by Darin Adler.

After r191652, a form's target attribute can no longer refer to a frame's id,
only its name. This is because the frame's id no longer sets the Window name
when the frame's name attribute is missing. This caused a change in behavior
for the fast/events/form-iframe-target-before-load-crash*.html tests, which
exposed a pre-existing bug.

This patch updates the fast/events/form-iframe-target-before-load-crash*.html
tests so they keep testing the same thing as before r191652. It also adds a
variant to keep covering the newly exposed bug.

The issue was that the frame was no longer navigated when submitting the form
(due to the form's target not matching the frame name). Therefore, when
removing the iframe from the document, its navigation has not started yet and
DocumentLoadTiming::navigationStart() is not initialized yet when
FrameLoader::stopLoading() is called and we hit an assertion. This patch
replaces the assertion with an if check as we now know it can happen and we
have test coverage for it.

Test: fast/events/form-iframe-target-before-load-crash.html

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::stopLoading):

LayoutTests:

<rdar://problem/23294110>

Reviewed by Darin Adler.

* fast/events/form-iframe-target-before-load-crash2.html:
Set the frame name so that the test still tests the same thing as it was
originally testing before r191652. This is needed because the frame id
no longer sets the window name and therefore no longer matches the form's
target.

* fast/events/form-iframe-target-before-load-crash3-expected.txt: Added.
* fast/events/form-iframe-target-before-load-crash3.html: Added.
This is a version on fast/events/form-iframe-target-before-load-crash.html
with the frame name set so that it tests the same thing it was originally
testing before r191652. form-iframe-target-before-load-crash.html is kept
as is (without frame name) as it exposed a new crash.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@191688 268f45cc-cd09-0410-ab3c-d52691b4dbfc