Prevent the destruction of WebContents in NavigationThrottle methods

content/browser/frame_host/navigation_handle_impl.cc

Index: content/browser/frame_host/navigation_handle_impl.cc
diff --git a/content/browser/frame_host/navigation_handle_impl.cc b/content/browser/frame_host/navigation_handle_impl.cc
index b1aace3597c5ecd773339efa3b2472beac3db8a7..46d7c784873fa5570fa5070537b48f376844410c 100644
--- a/content/browser/frame_host/navigation_handle_impl.cc
+++ b/content/browser/frame_host/navigation_handle_impl.cc
@@ -80,6 +80,14 @@ NavigationHandleImpl::NavigationHandleImpl(const GURL& url,
 
 NavigationHandleImpl::~NavigationHandleImpl() {
   GetDelegate()->DidFinishNavigation(this);
+
+  // Cancel the navigation on the IO thread if the NavigationHandle was
+  // destroyed in the middle of the NavigationThrottles checks.
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation) &&
+      !complete_callback_.is_null()) {
+    complete_callback_.Run(NavigationThrottle::CANCEL_AND_IGNORE);
+  }
 }
 
 NavigatorDelegate* NavigationHandleImpl::GetDelegate() const {
@@ -159,8 +167,14 @@ void NavigationHandleImpl::Resume() {
     result = CheckWillRedirectRequest();
   }
 
-  if (result != NavigationThrottle::DEFER)
-    complete_callback_.Run(result);
+  // If the navigation is not deferred and the NavigationHandle wasn't
+  // destroyed, run the callback.
+  if (result == NavigationThrottle::DEFER ||
+      result == NavigationThrottle::DESTROYED)
+    return;
+
+  complete_callback_.Run(result);
+  complete_callback_.Reset();
 }
 
 void NavigationHandleImpl::RegisterThrottleForTesting(
@@ -233,9 +247,14 @@ void NavigationHandleImpl::WillStartRequest(
   // Notify each throttle of the request.
   NavigationThrottle::ThrottleCheckResult result = CheckWillStartRequest();
 
-  // If the navigation is not deferred, run the callback.
-  if (result != NavigationThrottle::DEFER)
-    callback.Run(result);
+  // If the navigation is not deferred and the NavigationHandle wasn't
+  // destroyed, run the callback.
+  if (result == NavigationThrottle::DEFER ||
+      result == NavigationThrottle::DESTROYED)
+    return;
+
+  complete_callback_.Run(result);
+  complete_callback_.Reset();
 }
 
 void NavigationHandleImpl::WillRedirectRequest(
@@ -257,9 +276,14 @@ void NavigationHandleImpl::WillRedirectRequest(
   // Notify each throttle of the request.
   NavigationThrottle::ThrottleCheckResult result = CheckWillRedirectRequest();
 
-  // If the navigation is not deferred, run the callback.
-  if (result != NavigationThrottle::DEFER)
-    callback.Run(result);
+  // If the navigation is not deferred and the NavigationHandle wasn't
+  // destroyed, run the callback.
+  if (result == NavigationThrottle::DEFER ||
+      result == NavigationThrottle::DESTROYED)
+    return;
+
+  complete_callback_.Run(result);
+  complete_callback_.Reset();
 }
 
 void NavigationHandleImpl::DidRedirectNavigation(const GURL& new_url) {
@@ -297,6 +321,7 @@ NavigationHandleImpl::CheckWillStartRequest() {
         continue;
 
       case NavigationThrottle::CANCEL_AND_IGNORE:
+      case NavigationThrottle::DESTROYED:
         return result;
 
       case NavigationThrottle::DEFER:
@@ -326,6 +351,7 @@ NavigationHandleImpl::CheckWillRedirectRequest() {
         continue;
 
       case NavigationThrottle::CANCEL_AND_IGNORE:
+      case NavigationThrottle::DESTROYED:
         return result;
 
       case NavigationThrottle::DEFER: