WebContents could be blocked after pending cross-site navigation is canceled.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 868b9dd5c1379e1e80b0d388ebe08e6a309ee0d7..0b3162782c30525c88d6cce2f97babd782e51ae5 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -521,9 +521,11 @@ void RenderFrameHostImpl::SwapOut() {
   // when swapping out the main frame.
   if (!GetParent()) {
     // If this RenderViewHost is not in the default state, it must have already
-    // gone through this, therefore just return.
-    if (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT)
+    // gone through this, therefore return but proceed with the navigation.
+    if (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT) {
+      frame_tree_node_->render_manager()->SwappedOut(this);

[Charlie Reis, 2014/04/04 22:23:02]

Wait, this is a totally separate issue that we haven't discussed here.  I don't
see why it's needed, or a test for it.  Can we review this in a separate CL?

       return;
+    }
 
     render_view_host_->SetState(
         RenderViewHostImpl::STATE_WAITING_FOR_UNLOAD_ACK);
@@ -565,8 +567,12 @@ void RenderFrameHostImpl::OnBeforeUnloadACK(
   // If this renderer navigated while the beforeunload request was in flight, we
   // may have cleared this state in OnNavigate, in which case we can ignore
   // this message.
-  if (!render_view_host_->is_waiting_for_beforeunload_ack_ ||
-      render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT) {
+  // However renderer might also be swapped out but we still want to proceed
+  // with navigation, otherwise it would block whole web_contents. This can

[Charlie Reis, 2014/04/04 22:23:02]

nit: block whole web_contents -> block future navigations

(This issue isn't specific to WebContents.)

+  // happen when pending cross-site navigation is canceled by second one just

[Charlie Reis, 2014/04/04 22:23:02]

nit: a second one

+  // before OnNavigate, current (loaded) RVH is waiting for commit but second

[Charlie Reis, 2014/04/04 22:23:02]

This is a run-on sentence.  Do you mean ", while the current..." or something
else?

+  // navigation is started from the beginning.
+  if (!render_view_host_->is_waiting_for_beforeunload_ack_) {
     return;
   }