WebContents could be blocked after pending cross-site navigation is canceled.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
 #include "base/metrics/user_metrics_action.h"
 #include "content/browser/child_process_security_policy_impl.h"
@@ skipping 503 matching lines @@
       this, global_request_id, cross_site_transferring_request.Pass(),
       transfer_url_chain, referrer, page_transition,
       should_replace_current_entry);
 }
 
 void RenderFrameHostImpl::SwapOut() {
   // TODO(creis): Move swapped out state to RFH.  Until then, only update it
   // when swapping out the main frame.
   if (!GetParent()) {
     // If this RenderViewHost is not in the default state, it must have already
-    // gone through this, therefore just return.
-    if (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT)
+    // gone through this, therefore return but proceed with the navigation.
+    if (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT) {
+      frame_tree_node_->render_manager()->SwappedOut(this);

[Charlie Reis, 2014/04/04 22:23:02]

Wait, this is a totally separate issue that we haven't discussed here.  I don't
see why it's needed, or a test for it.  Can we review this in a separate CL?

       return;
+    }
 
     render_view_host_->SetState(
         RenderViewHostImpl::STATE_WAITING_FOR_UNLOAD_ACK);
     render_view_host_->unload_event_monitor_timeout_->Start(
         base::TimeDelta::FromMilliseconds(
             RenderViewHostImpl::kUnloadTimeoutMS));
   }
 
   if (render_view_host_->IsRenderViewLive())
     Send(new FrameMsg_SwapOut(routing_id_));
@@ skipping 21 matching lines @@
   if (GetParent()) {
     NOTREACHED() << "Should only receive BeforeUnload_ACK from the main frame.";
     return;
   }
 
   render_view_host_->decrement_in_flight_event_count();
   render_view_host_->StopHangMonitorTimeout();
   // If this renderer navigated while the beforeunload request was in flight, we
   // may have cleared this state in OnNavigate, in which case we can ignore
   // this message.
-  if (!render_view_host_->is_waiting_for_beforeunload_ack_ ||
-      render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT) {
+  // However renderer might also be swapped out but we still want to proceed
+  // with navigation, otherwise it would block whole web_contents. This can

[Charlie Reis, 2014/04/04 22:23:02]

nit: block whole web_contents -> block future navigations

(This issue isn't specific to WebContents.)

+  // happen when pending cross-site navigation is canceled by second one just

[Charlie Reis, 2014/04/04 22:23:02]

nit: a second one

+  // before OnNavigate, current (loaded) RVH is waiting for commit but second

[Charlie Reis, 2014/04/04 22:23:02]

This is a run-on sentence.  Do you mean ", while the current..." or something
else?

+  // navigation is started from the beginning.
+  if (!render_view_host_->is_waiting_for_beforeunload_ack_) {
     return;
   }
 
   render_view_host_->is_waiting_for_beforeunload_ack_ = false;
 
   base::TimeTicks before_unload_end_time;
   if (!send_before_unload_start_time_.is_null() &&
       !renderer_before_unload_start_time.is_null() &&
       !renderer_before_unload_end_time.is_null()) {
     // When passing TimeTicks across process boundaries, we need to compensate
@@ skipping 145 matching lines @@
                                       const gfx::Point& end) {
   Send(new InputMsg_SelectRange(routing_id_, start, end));
 }
 
 void RenderFrameHostImpl::ExtendSelectionAndDelete(size_t before,
                                                    size_t after) {
   Send(new FrameMsg_ExtendSelectionAndDelete(routing_id_, before, after));
 }
 
 }  // namespace content