Do not create pending NavigationEntry when a transient one is present.

content/browser/frame_host/navigator_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigator_impl.h"
 
 #include <utility>
 
 #include "base/metrics/histogram.h"
 #include "base/time/time.h"
@@ skipping 1007 matching lines @@
     SiteInstanceImpl* site_instance,
     NavigationHandleImpl* navigation_handle) {
   // If there is no browser-initiated pending entry for this navigation and it
   // is not for the error URL, create a pending entry using the current
   // SiteInstance, and ensure the address bar updates accordingly.  We don't
   // know the referrer or extra headers at this point, but the referrer will
   // be set properly upon commit.
   NavigationEntryImpl* pending_entry = controller_->GetPendingEntry();
   bool has_browser_initiated_pending_entry =
       pending_entry && !pending_entry->is_renderer_initiated();
-  if (!has_browser_initiated_pending_entry) {
+
+  // If there is a transient entry, creating a new pending entry will result
+  // in deleting it, which leads to inconsistent state.
+  bool has_transient_entry = !!controller_->GetTransientEntry();

[Charlie Reis, 2016/04/13 06:03:37]

I still think this is correct, but I just want to make sure we're doing the
right thing.

Suppose URL A causes an interstitial in a new tab, and it has a
renderer-initiated pending entry.  Then renderer-initiated URL B gets here.  We
skip the block below because there's an interstitial, so we still have the
pending entry for A.  If the interstitial gets dismissed, the renderer-initiated
pending entry could be displayed, and it would be for A rather than B?  (Or
maybe we'd get a DidFail and cancel it?)

I'm mainly wondering if we need to discard the pending entry (and not the
transient entry) in this case, or if just skipping the block below is
sufficient.

[Charlie Reis, 2016/04/14 23:02:45]

From your email, it sounds like we'll hang if we proceed after trying to
navigate to B.  I'm not too concerned, then.

+
+  if (!has_browser_initiated_pending_entry && !has_transient_entry) {
     std::unique_ptr<NavigationEntryImpl> entry =
         NavigationEntryImpl::FromNavigationEntry(
             controller_->CreateNavigationEntry(
                 url, content::Referrer(), ui::PAGE_TRANSITION_LINK,
                 true /* is_renderer_initiated */, std::string(),
                 controller_->GetBrowserContext()));
     entry->set_site_instance(site_instance);
     // TODO(creis): If there's a pending entry already, find a safe way to
     // update it instead of replacing it and copying over things like this.
     // That will allow us to skip the NavigationHandle update below as well.
@@ skipping 51 matching lines @@
   if (pending_entry != controller_->GetVisibleEntry() ||
       !should_preserve_entry) {
     controller_->DiscardPendingEntry(true);
 
     // Also force the UI to refresh.
     controller_->delegate()->NotifyNavigationStateChanged(INVALIDATE_TYPE_URL);
   }
 }
 
 }  // namespace content