Fix content script injection for cancelled loads with PlzNavigate.

content/browser/frame_host/navigation_handle_impl.h

Index: content/browser/frame_host/navigation_handle_impl.h
diff --git a/content/browser/frame_host/navigation_handle_impl.h b/content/browser/frame_host/navigation_handle_impl.h
index 58aff96b249dfb6a28b8b30a6bf62f8543029eda..96589fb4ddd5e28242cf8014c324e58d4184dad9 100644
--- a/content/browser/frame_host/navigation_handle_impl.h
+++ b/content/browser/frame_host/navigation_handle_impl.h
@@ -254,6 +254,11 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
       bool same_page,
       RenderFrameHostImpl* render_frame_host);
 
+  // Called when a 204 or 205 response is received, which abort the commit.

[Charlie Reis, 2016/10/31 17:05:28]

From NavigationHandle's perspective, how is a 204 or 205 different from a
navigation that turns out to be a download (which also doesn't commit)?  Should
we be including downloads in this?

+  void AbortCommit(
+      RenderFrameHostImpl* render_frame_host,
+      scoped_refptr<net::HttpResponseHeaders> response_headers);
+
   // Called during commit. Takes ownership of the embedder's NavigationData
   // instance. This NavigationData may have been cloned prior to being added
   // here.
@@ -293,6 +298,7 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
     WILL_PROCESS_RESPONSE,
     DEFERRING_RESPONSE,
     READY_TO_COMMIT,
+    DID_ABORT_COMMIT,
     DID_COMMIT,
     DID_COMMIT_ERROR_PAGE,
   };