This is a companion bug to 44784. FrameLoaderClient::createFrame calls loadURLInChildFrame on the new frame's FrameLoader. This should happen on the parent frame's FrameLoader.
Created attachment 81458 [details] Patch
Comment on attachment 81458 [details] Patch r=me
Comment on attachment 81458 [details] Patch Clearing flags on attachment: 81458 Committed r77813: <http://trac.webkit.org/changeset/77813>
All reviewed patches have been landed. Closing bug.