WebContents could be blocked after pending cross-site navigation is canceled.

content/browser/frame_host/render_frame_host_manager_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/files/file_path.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/frame_host/cross_site_transferring_request.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigator.h"
@@ skipping 932 matching lines @@
   EXPECT_TRUE(static_cast<SiteInstanceImpl*>(host3->GetSiteInstance())->
       HasSite());
   // Check the pending RenderFrameHost has been committed.
   EXPECT_FALSE(manager->pending_frame_host());
 
   // We should observe a notification.
   EXPECT_TRUE(
       notifications.Check1AndReset(NOTIFICATION_RENDER_VIEW_HOST_CHANGED));
 }
 
+// Test that navigation is not blocked when we make new navigation before
+// previous one has been committed. This is also a regression test for
+// http://crbug.com/104600.
+TEST_F(RenderFrameHostManagerTest, NewCrossNavigationBetweenSwapOutAndCommit) {
+  const GURL kUrl1("http://www.google.com/");
+  const GURL kUrl2("http://www.chromium.org/");
+  const GURL kUrl3("http://www.youtube.com/");
+
+  contents()->NavigateAndCommit(kUrl1);
+  TestRenderViewHost* rvh1 = test_rvh();
+
+  // Keep active_view_count nonzero so that no swapped out views in
+  // this SiteInstance get forcefully deleted.
+  static_cast<SiteInstanceImpl*>(rvh1->GetSiteInstance())->
+      increment_active_view_count();
+
+  // Navigate but don't commit.
+  contents()->GetController().LoadURL(
+      kUrl2, Referrer(), PAGE_TRANSITION_LINK, std::string());
+  EXPECT_TRUE(rvh1->is_waiting_for_beforeunload_ack());
+  contents()->ProceedWithCrossSiteNavigation();
+  EXPECT_FALSE(rvh1->is_waiting_for_beforeunload_ack());
+  StartCrossSiteTransition(contents());
+  EXPECT_TRUE(rvh1->IsWaitingForUnloadACK());
+
+  rvh1->OnSwappedOut(false);
+  EXPECT_EQ(RenderViewHostImpl::STATE_WAITING_FOR_COMMIT, rvh1->rvh_state());
+
+  TestRenderViewHost* rvh2 = pending_test_rvh();
+  EXPECT_NE(rvh2, nullptr);

[Charlie Reis, 2014/03/31 21:17:51]

For consistency in this file, please use EXPECT_TRUE(rvh2) instead of comparing
to nullptr.  Same below.

(Also, in general EXPECT_EQ takes the expected value first and then the actual
value, which affects how the error message is displayed if it fails.)

+  static_cast<SiteInstanceImpl*>(rvh2->GetSiteInstance())->
+      increment_active_view_count();
+
+  contents()->GetController().LoadURL(
+      kUrl3, Referrer(), PAGE_TRANSITION_LINK, std::string());
+  // Pending rvh2 should be already deleted.
+  contents()->ProceedWithCrossSiteNavigation();
+
+  TestRenderViewHost* rvh3 = pending_test_rvh();
+  EXPECT_NE(rvh3, nullptr);
+  // Navigation should be already unblocked by rvh1.
+  EXPECT_FALSE(rvh3->are_navigations_suspended());
+}
+
 // Tests WebUI creation.
 TEST_F(RenderFrameHostManagerTest, WebUI) {
   set_should_create_webui(true);
   SiteInstance* instance = SiteInstance::Create(browser_context());
 
   scoped_ptr<TestWebContents> web_contents(
       TestWebContents::Create(browser_context(), instance));
   FrameTree tree(web_contents->GetFrameTree()->root()->navigator(),
                  web_contents.get(), web_contents.get(),
                  web_contents.get(), web_contents.get());
@@ skipping 751 matching lines @@
 
   // Simulate the swap out ack.
   rvh1->OnSwappedOut(false);
 
   // rvh1 should be swapped out.
   EXPECT_FALSE(rvh_deleted_observer.deleted());
   EXPECT_TRUE(rvh1->IsSwappedOut());
 }
 
 }  // namespace content