Bug 1803152, destroy nsFrameLoader asynchronously when destroyed from SessionHistoryEntry's/SHEntrySharedParentState's destructor. r=nika

Differential Revision: https://phabricator.services.mozilla.com/D163344

docshell/shistory/nsSHEntryShared.cpp

@@ -73,7 +73,7 @@ SHEntrySharedParentState::~SHEntrySharedParentState() {
   RefPtr<nsFrameLoader> loader = mFrameLoader;
   SetFrameLoader(nullptr);
   if (loader) {
-    loader->Destroy();
+    loader->AsyncDestroy();
   }
 
   sIdToSharedState->Remove(mId);

dom/base/nsFrameLoader.h

@@ -213,6 +213,11 @@ class nsFrameLoader final : public nsStubMutationObserver,
    */
   void Destroy(bool aForProcessSwitch = false);
 
+  void AsyncDestroy() {
+    mNeedsAsyncDestroy = true;
+    Destroy();
+  }
+
   void RequestUpdatePosition(mozilla::ErrorResult& aRv);
 
   already_AddRefed<Promise> RequestTabStateFlush(mozilla::ErrorResult& aRv);