WebContents could be blocked after pending cross-site navigation is canceled.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
 #include "base/metrics/user_metrics_action.h"
 #include "content/browser/child_process_security_policy_impl.h"
@@ skipping 547 matching lines @@
   if (GetParent()) {
     NOTREACHED() << "Should only receive BeforeUnload_ACK from the main frame.";
     return;
   }
 
   render_view_host_->decrement_in_flight_event_count();
   render_view_host_->StopHangMonitorTimeout();
   // If this renderer navigated while the beforeunload request was in flight, we
   // may have cleared this state in OnNavigate, in which case we can ignore
   // this message.
-  if (!render_view_host_->is_waiting_for_beforeunload_ack_ ||
-      render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT) {
+  // However renderer might also be swapped out but we still want to proceed
+  // with navigation, otherwise it would block future navigations. This can
+  // happen when pending cross-site navigation is canceled by a second one just
+  // before OnNavigate while current RVH is waiting for commit but second
+  // navigation is started from the beginning.
+  if (!render_view_host_->is_waiting_for_beforeunload_ack_) {
     return;
   }
 
   render_view_host_->is_waiting_for_beforeunload_ack_ = false;
 
   base::TimeTicks before_unload_end_time;
   if (!send_before_unload_start_time_.is_null() &&
       !renderer_before_unload_start_time.is_null() &&
       !renderer_before_unload_end_time.is_null()) {
     // When passing TimeTicks across process boundaries, we need to compensate
@@ skipping 145 matching lines @@
                                       const gfx::Point& end) {
   Send(new InputMsg_SelectRange(routing_id_, start, end));
 }
 
 void RenderFrameHostImpl::ExtendSelectionAndDelete(size_t before,
                                                    size_t after) {
   Send(new FrameMsg_ExtendSelectionAndDelete(routing_id_, before, after));
 }
 
 }  // namespace content