PlzNavigate: destroy the speculative RFH on renderer-initiated navigations

content/browser/frame_host/navigator_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigator_impl.h"
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
 #include "base/time/time.h"
 #include "content/browser/frame_host/frame_tree.h"
@@ skipping 632 matching lines @@
   // ongoing request b) which is browser or user-initiated and c) the renderer
   // request is not user-initiated.
   if (ongoing_navigation_request &&
       (ongoing_navigation_request->browser_initiated() ||
        ongoing_navigation_request->begin_params().has_user_gesture) &&
       !begin_params.has_user_gesture) {
     return;
   }
 
   // In all other cases the current navigation, if any, is canceled and a new
-  // NavigationRequest is created and stored in the map. Actual cancellation
-  // happens when the existing request map entry is replaced and destroyed.
+  // NavigationRequest is created and stored in the map.
+  if (ongoing_navigation_request)
+    CancelNavigation(frame_tree_node);
+
   scoped_ptr<NavigationRequest> navigation_request =
       NavigationRequest::CreateRendererInitiated(
           frame_tree_node, common_params, begin_params, body,
           controller_->GetLastCommittedEntryIndex(),
           controller_->GetEntryCount());
   navigation_request_map_.set(
       frame_tree_node->frame_tree_node_id(), navigation_request.Pass());
 
   if (frame_tree_node->IsMainFrame())
     navigation_data_.reset();
@@ skipping 116 matching lines @@
   int64 frame_tree_node_id = frame_tree_node->frame_tree_node_id();
   FrameMsg_Navigate_Type::Value navigation_type =
       GetNavigationType(controller_->GetBrowserContext(), entry, reload_type);
   scoped_ptr<NavigationRequest> navigation_request =
       NavigationRequest::CreateBrowserInitiated(frame_tree_node, entry,
                                                 navigation_type,
                                                 navigation_start, controller_);
   // TODO(clamy): Check if navigations are blocked and if so store the
   // parameters.
 
-  // If there is an ongoing request, replace it.
+  // If there is an ongoing request, cancel and replace it.
+  NavigationRequest* ongoing_request =
+      navigation_request_map_.get(frame_tree_node->frame_tree_node_id());
+  if (ongoing_request)
+    CancelNavigation(frame_tree_node);
+
   navigation_request_map_.set(frame_tree_node_id, navigation_request.Pass());
 
   // Have the current renderer execute its beforeUnload event if needed. If it
   // is not needed (eg. the renderer is not live), BeginNavigation should get
   // called.
   NavigationRequest* request_to_send =
       navigation_request_map_.get(frame_tree_node_id);
   request_to_send->SetWaitingForRendererResponse();
   frame_tree_node->current_frame_host()->DispatchBeforeUnload(true);
 }
@@ skipping 64 matching lines @@
         "Navigation.TimeToCommit_ExistingRenderer_BeforeUnloadDiscounted",
         time_to_commit);
     UMA_HISTOGRAM_TIMES(
         "Navigation.TimeToURLJobStart_ExistingRenderer_BeforeUnloadDiscounted",
         time_to_network);
   }
   navigation_data_.reset();
 }
 
 }  // namespace content