fix($rootScope): remove history event handler when app is torn down

Remember the popstate and hashchange handler registered with window
when the application bootstraps, and remove it when the application
is torn down

Closes angular#9897

Author: randombk

src/ng/browser.js

@@ -293,6 +293,16 @@ function Browser(window, document, $log, $sniffer) {
     return callback;
   };
 
+  /**
+   * @private
+   * Remove popstate and hashchange handler from window.
+   *
+   * NOTE: this api is intended for use only by $rootScope.
+   */
+  self.$$applicationDestroyed = function() {
+    jqLite(window).off('hashchange popstate', cacheStateAndFireUrlChange);
+  };
+
   /**
    * Checks whether the url has changed outside of Angular.
    * Needs to be exported to be able to check for changes that have been done in sync,

src/ng/rootScope.js

@@ -861,7 +861,12 @@ function $RootScopeProvider() {
 
         this.$broadcast('$destroy');
         this.$$destroyed = true;
-        if (this === $rootScope) return;
+
+        if (this === $rootScope) {
+          //Remove handlers attached to window when $rootScope is removed
+          $browser.$$applicationDestroyed();
+          return;
+        }
 
         for (var eventName in this.$$listenerCount) {
           decrementListenerCount(this, this.$$listenerCount[eventName], eventName);

src/ngMock/angular-mocks.js

@@ -57,6 +57,7 @@ angular.mock.$Browser = function() {
     return listener;
   };
 
+  self.$$applicationDestroyed = angular.noop;
   self.$$checkUrlChange = angular.noop;
 
   self.cookieHash = {};