PlzNavigate: fix SecurityExploitBrowserTest.MismatchedOriginOnCommit

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 8aa0f8356f7efb9222f9ef66df6110559d16f6c5..def3905e17fb9c5d18ffa7c1cc153a3d3a21b38b 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -922,6 +922,8 @@ void RenderFrameHostImpl::OnDidCommitProvisionalLoad(const IPC::Message& msg) {
       Read(&msg, &iter, &validated_params)) {
     bad_message::ReceivedBadMessage(
         process, bad_message::RFH_COMMIT_DESERIALIZATION_FAILED);
+    // PlzNavigate: release the stream now that the renderer is going away.
+    stream_handle_.reset();
     return;
   }
   TRACE_EVENT1("navigation", "RenderFrameHostImpl::OnDidCommitProvisionalLoad",
@@ -976,6 +978,8 @@ void RenderFrameHostImpl::OnDidCommitProvisionalLoad(const IPC::Message& msg) {
     // Kills the process.
     bad_message::ReceivedBadMessage(process,
                                     bad_message::RFH_CAN_COMMIT_URL_BLOCKED);
+    // PlzNavigate: release the stream now that the renderer is going away.
+    stream_handle_.reset();
     return;
   }
 
@@ -984,6 +988,8 @@ void RenderFrameHostImpl::OnDidCommitProvisionalLoad(const IPC::Message& msg) {
   if (!CanCommitOrigin(validated_params.origin, validated_params.url)) {
     bad_message::ReceivedBadMessage(GetProcess(),
                                     bad_message::RFH_INVALID_ORIGIN_ON_COMMIT);
+    // PlzNavigate: release the stream now that the renderer is going away.
+    stream_handle_.reset();
     return;
   }
 
@@ -1008,6 +1014,8 @@ void RenderFrameHostImpl::OnDidCommitProvisionalLoad(const IPC::Message& msg) {
           validated_params.page_state)) {
     bad_message::ReceivedBadMessage(
         GetProcess(), bad_message::RFH_CAN_ACCESS_FILES_OF_PAGE_STATE);
+    // PlzNavigate: release the stream now that the renderer is going away.
+    stream_handle_.reset();

[nasko, 2016/03/18 20:41:14]

Instead of putting these in all cases where we kill the renderer, why not
include the code in ::RenderProcessGone? This will be a good catch all and less
prone to people forgetting to add this call.

[clamy, 2016/03/22 16:46:55]

Actually we already do (in the SiteInstance version which calls
ResetLoadingState). Removed those calls.

     return;
   }