WebContents could be blocked after pending cross-site navigation is canceled.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
 #include "base/metrics/user_metrics_action.h"
 #include "content/browser/child_process_security_policy_impl.h"
@@ skipping 510 matching lines @@
   if (GetParent()) {
     NOTREACHED() << "Should only receive BeforeUnload_ACK from the main frame.";
     return;
   }
 
   render_view_host_->decrement_in_flight_event_count();
   render_view_host_->StopHangMonitorTimeout();
   // If this renderer navigated while the beforeunload request was in flight, we
   // may have cleared this state in OnNavigate, in which case we can ignore
   // this message.
+  // However renderer might also be swapped out but we still want to proceed
+  // with navigation, otherwise it would block whole web_contents. This can
+  // happen when pending cross-site navigation is canceled by second one just
+  // before OnNavigate, current (loaded) RVH is waiting for commit but second
+  // navigation is started from the beginning.
   if (!render_view_host_->is_waiting_for_beforeunload_ack_ ||
-      render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT) {
+      (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT &&
+       render_view_host_->rvh_state_ !=
+           RenderViewHostImpl::STATE_WAITING_FOR_COMMIT)) {
     return;
   }
 
   render_view_host_->is_waiting_for_beforeunload_ack_ = false;
 
   base::TimeTicks before_unload_end_time;
   if (!send_before_unload_start_time_.is_null() &&
       !renderer_before_unload_start_time.is_null() &&
       !renderer_before_unload_end_time.is_null()) {
     // When passing TimeTicks across process boundaries, we need to compensate
@@ skipping 135 matching lines @@
   params.navigation_type = FrameMsg_Navigate_Type::NORMAL;
   Navigate(params);
 }
 
 void RenderFrameHostImpl::SelectRange(const gfx::Point& start,
                                       const gfx::Point& end) {
   Send(new InputMsg_SelectRange(routing_id_, start, end));
 }
 
 }  // namespace content