Add checks to understand crash in NavigationHandle::DidCommitNavigation

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/containers/hash_tables.h"
@@ skipping 1031 matching lines @@
       // has not been notified about the start of the load yet. Do it now.
       if (!is_loading()) {
         bool was_loading = frame_tree_node()->frame_tree()->IsLoading();
         is_loading_ = true;
         frame_tree_node()->DidStartLoading(true, was_loading);
       }
       pending_commit_ = false;
     }
   }
 
+  CHECK(navigation_handle_);

[nasko, 2016/02/25 16:47:19]

I don't see how this will be nullptr. It is tested on line 1025 and 1033. If it
was nullptr, it will be allocated on 1035.

[clamy, 2016/02/26 12:41:02]

Removed the check.

+  CHECK_EQ(navigation_handle_->GetURL(), validated_params.url);

[nasko, 2016/02/25 16:47:19]

Same thing here. It is checked on 1026 and if the handle was deleted, the new
one is explicitly initialized with validated_params.url.

[clamy, 2016/02/26 12:41:02]

I know but we're still hitting the check in NavigationHandleImpl (which does not
make much sense to me). This is just temporarily there to ensure that we have
the right values before calling NavigatorImpl::DidNavigate.

+
   accessibility_reset_count_ = 0;
   frame_tree_node()->navigator()->DidNavigate(this, validated_params);
 
   // For a top-level frame, there are potential security concerns associated
   // with displaying graphics from a previously loaded page after the URL in
   // the omnibar has been changed. It is unappealing to clear the page
   // immediately, but if the renderer is taking a long time to issue any
   // compositor output (possibly because of script deliberately creating this
   // situation) then we clear it after a while anyway.
   // See https://crbug.com/497588.
@@ skipping 1537 matching lines @@
   *dst = src;
 
   if (src.routing_id != -1)
     dst->tree_id = RoutingIDToAXTreeID(src.routing_id);
 
   if (src.parent_routing_id != -1)
     dst->parent_tree_id = RoutingIDToAXTreeID(src.parent_routing_id);
 }
 
 }  // namespace content