Ensure RenderFrameHost & NavigationHandle are not destroyed during commit

content/browser/frame_host/render_frame_host_impl.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_FRAME_HOST_RENDER_FRAME_HOST_IMPL_H_
 #define CONTENT_BROWSER_FRAME_HOST_RENDER_FRAME_HOST_IMPL_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 924 matching lines @@
   // The pending WebUIImpl and its type. These values will be used exclusively
   // for same-site navigations to keep a transition of a WebUI in a pending
   // state until the navigation commits.
   scoped_ptr<WebUIImpl> pending_web_ui_;
   WebUI::TypeID pending_web_ui_type_;
 
   // If true the associated WebUI should be reused when CommitPendingWebUI is
   // called (no pending instance should be set).
   bool should_reuse_web_ui_;
 
+  // True if the RenderFrameHost is in the process of committing a navigation.
+  // This is temporary to help pinpoint the cause of crbug.com/589365.
+  // TODO(clamy): Remove once enough data has been gathered.
+  bool is_in_commit_;
+
   // NOTE: This must be the last member.
   base::WeakPtrFactory<RenderFrameHostImpl> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameHostImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_FRAME_HOST_RENDER_FRAME_HOST_IMPL_H_