Fix content script injection for cancelled loads with PlzNavigate.

content/browser/frame_host/navigation_handle_impl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_handle_impl.h"
 
 #include <utility>
 
 #include "base/debug/dump_without_crashing.h"
 #include "base/logging.h"
@@ skipping 482 matching lines @@
   state_ = READY_TO_COMMIT;
 
   GetDelegate()->ReadyToCommitNavigation(this);
 }
 
 void NavigationHandleImpl::DidCommitNavigation(
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
     bool same_page,
     RenderFrameHostImpl* render_frame_host) {
   DCHECK(!render_frame_host_ || render_frame_host_ == render_frame_host);
   DCHECK_EQ(frame_tree_node_, render_frame_host->frame_tree_node());

[Charlie Reis, 2016/10/31 17:05:28]

We should probably have these first two DCHECKs in AbortCommit, since a
different RFH shouldn't be interfering with an unrelated NavigationHandle.

   CHECK_EQ(url_, params.url);
 
   method_ = params.method;
   has_user_gesture_ = (params.gesture == NavigationGestureUser);
   transition_ = params.transition;
   render_frame_host_ = render_frame_host;
   is_same_page_ = same_page;
 
   // If an error page reloads, net_error_code might be 200 but we still want to
   // count it as an error page.
   if (params.base_url.spec() == kUnreachableWebDataURL ||
       net_error_code_ != net::OK) {
     state_ = DID_COMMIT_ERROR_PAGE;
   } else {
     state_ = DID_COMMIT;
   }
 }
 
+void NavigationHandleImpl::AbortCommit(
+    RenderFrameHostImpl* render_frame_host,
+    scoped_refptr<net::HttpResponseHeaders> response_headers) {
+  state_ = DID_ABORT_COMMIT;
+  render_frame_host_ = render_frame_host;
+  response_headers_ = response_headers;
+}
+
 void NavigationHandleImpl::Transfer() {
   DCHECK(!IsBrowserSideNavigationEnabled());
   // This is an actual transfer. Inform the NavigationResourceThrottle. This
   // will allow to mark the URLRequest as transferring. When it is marked as
   // transferring, the URLRequest can no longer be cancelled by its original
   // RenderFrame. Instead it will persist until being picked up by the transfer
   // RenderFrame, even if the original RenderFrame is destroyed.
   BrowserThread::PostTask(BrowserThread::IO, FROM_HERE, transfer_callback_);
   transfer_callback_.Reset();
 }
@@ skipping 220 matching lines @@
                       throttles_to_register.end());
     throttles_to_register.weak_clear();
   }
 }
 
 bool NavigationHandleImpl::WasStartedFromContextMenu() const {
   return started_from_context_menu_;
 }
 
 }  // namespace content