WebContents could be blocked after pending cross-site navigation is canceled.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
 #include "base/metrics/user_metrics_action.h"
 #include "content/browser/child_process_security_policy_impl.h"
@@ skipping 510 matching lines @@
   if (GetParent()) {
     NOTREACHED() << "Should only receive BeforeUnload_ACK from the main frame.";
     return;
   }
 
   render_view_host_->decrement_in_flight_event_count();
   render_view_host_->StopHangMonitorTimeout();
   // If this renderer navigated while the beforeunload request was in flight, we
   // may have cleared this state in OnNavigate, in which case we can ignore
   // this message.
+  // However renderer might also be swapped out but we still want to proceed
+  // with navigation, otherwise it would block whole web_contents. This can
+  // happen when pending cross-site navigation is canceled by second one just
+  // before OnNavigate, current (loaded) RVH is waiting for commit but second
+  // navigation is started from the beginning.
   if (!render_view_host_->is_waiting_for_beforeunload_ack_ ||
-      render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT) {
+      (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT &&
+       render_view_host_->rvh_state_ !=
+           RenderViewHostImpl::STATE_WAITING_FOR_COMMIT)) {

[Charlie Reis, 2014/03/28 16:43:20]

This doesn't seem right to me, since I don't yet see what's special about the
WAITING_FOR_COMMIT state.  Couldn't we be in a related state and hit the same
problem?  I'm wondering if we should be checking this in another way, using
something like IsRVHStateActive.

Note that this check used to look like this when it was in RVH, before the state
machine was introduced:
  if (!is_waiting_for_beforeunload_ack_ || is_swapped_out_)

Context:
https://codereview.chromium.org/88503002/diff/1740001/content/browser/rendere...

     return;
   }
 
   render_view_host_->is_waiting_for_beforeunload_ack_ = false;
 
   base::TimeTicks before_unload_end_time;
   if (!send_before_unload_start_time_.is_null() &&
       !renderer_before_unload_start_time.is_null() &&
       !renderer_before_unload_end_time.is_null()) {
     // When passing TimeTicks across process boundaries, we need to compensate
@@ skipping 135 matching lines @@
   params.navigation_type = FrameMsg_Navigate_Type::NORMAL;
   Navigate(params);
 }
 
 void RenderFrameHostImpl::SelectRange(const gfx::Point& start,
                                       const gfx::Point& end) {
   Send(new InputMsg_SelectRange(routing_id_, start, end));
 }
 
 }  // namespace content