Prevent the destruction of WebContents in NavigationThrottle methods

content/public/browser/navigation_throttle.h

Index: content/public/browser/navigation_throttle.h
diff --git a/content/public/browser/navigation_throttle.h b/content/public/browser/navigation_throttle.h
index c5202ae71d89d47990394423a87c943af488d66c..5531f464594ad80732975000fac1cd703f70c610 100644
--- a/content/public/browser/navigation_throttle.h
+++ b/content/public/browser/navigation_throttle.h
@@ -17,18 +17,37 @@ class CONTENT_EXPORT NavigationThrottle {
   // This is returned to the NavigationHandle to allow the navigation to
   // proceed, or to cancel it.
   enum ThrottleCheckResult {
+    // The navigation can proceed.
     PROCEED,
+
+    // The navigation is deferred until NavigationHandle::Resume is
+    // called.
     DEFER,
+
+    // The navigation is cancelled and the requester of the resource acts
+    // like the request was never made.
     CANCEL_AND_IGNORE,
+
+    // The NavigationRequest was destroyed during the call to WillStartRequest
+    // or the call to WillRedirectRequest.
+    DESTROYED,
   };
 
   NavigationThrottle(NavigationHandle* navigation_handle);
   virtual ~NavigationThrottle();
 
   // Called when a network request is about to be made for this navigation.
+  // Note: unless they return DESTROYED, NavigationThrottles must ensure that
+  // the WebContents is not destroyed during the execution of this function.
+  // Failing to do so will result in security-critical
+  // use-after-free bugs.
   virtual ThrottleCheckResult WillStartRequest();
 
   // Called when a server redirect is received by the navigation.
+  // Note: unless they return DESTROYED, NavigationThrottles must ensure that
+  // the WebContents is not destroyed during the execution of this function.
+  // Failing to do so will result in security-critical
+  // use-after-free bugs.
   virtual ThrottleCheckResult WillRedirectRequest();
 
   // The NavigationHandle that is tracking the information related to this