Ensure RenderFrameHost & NavigationHandle are not destroyed during commit

content/browser/frame_host/navigator_impl.cc

Index: content/browser/frame_host/navigator_impl.cc
diff --git a/content/browser/frame_host/navigator_impl.cc b/content/browser/frame_host/navigator_impl.cc
index baf2bcdb4c383096c4c14d1858a34ddb305befb7..d0a5d874274ec6eb1a56c017b86a8f7dacaa9001 100644
--- a/content/browser/frame_host/navigator_impl.cc
+++ b/content/browser/frame_host/navigator_impl.cc
@@ -602,9 +602,16 @@ void NavigatorImpl::DidNavigate(
                                         transition_type);
     render_frame_host->navigation_handle()->DidCommitNavigation(
         params, is_navigation_within_page, render_frame_host);
+
+    // TODO(clamy): Remove this once enough data has been gathered for
+    // crbug.com/589365.
+    render_frame_host->navigation_handle()->set_is_in_commit(false);
+
     render_frame_host->SetNavigationHandle(nullptr);
   }
 
+  // TODO(clamy): The NavigationHandle should always be reset here.

[nasko, 2016/03/15 14:10:34]

Why not add a CHECK to verify this?

[clamy, 2016/03/15 14:16:16]

Because I know for a fact that this isn't the case and I plan to fix it, but not
in that patch.

+
   if (!did_navigate)
     return;  // No navigation happened.