Change Document::detach() to RELEASE_ASSERT all subframes are gone.

BUG=556724,577105

Review URL: https://codereview.chromium.org/1667573002

Cr-Commit-Position: refs/heads/master@{#373642}
String Document::outgoingReferrer() const
{
    if (securityOrigin()->isUnique()) {
        return String();
    }

    const Document* referrerDocument = this;
    if (LocalFrame* frame = m_frame) {
        while (frame->document()->isSrcdocDocument()) {
            frame = toLocalFrame(frame->tree().parent());
            ASSERT(frame);
        }
        referrerDocument = frame->document();
    }
    return referrerDocument->m_url.strippedForUseAsReferrer();
}

String Document::outgoingReferrer() const
{
    if (securityOrigin()->isUnique()) {
        return String();
    }

    const Document* referrerDocument = this;
    if (LocalFrame* frame = m_frame) {
        while (frame->document()->isSrcdocDocument()) {
            frame = toLocalFrame(frame->tree().parent());
            ASSERT(frame);
        }
        referrerDocument = frame->document();
    }
    return referrerDocument->m_url.strippedForUseAsReferrer();
}
