Fix content script injection for cancelled loads with PlzNavigate.

content/browser/frame_host/navigation_request.cc

Index: content/browser/frame_host/navigation_request.cc
diff --git a/content/browser/frame_host/navigation_request.cc b/content/browser/frame_host/navigation_request.cc
index f5716b06df2fa83e181ce2f277ed129694c4fdf0..ba0b721b63b0e0928f9f6cc48ae74eea772e5b39 100644
--- a/content/browser/frame_host/navigation_request.cc
+++ b/content/browser/frame_host/navigation_request.cc
@@ -368,6 +368,9 @@ void NavigationRequest::OnResponseStarted(
   DCHECK(state_ == STARTED);
   state_ = RESPONSE_STARTED;
 
+  RenderFrameHostImpl* render_frame_host =
+      frame_tree_node_->render_manager()->GetFrameHostForNavigation(*this);
+
   // HTTP 204 (No Content) and HTTP 205 (Reset Content) responses should not
   // commit; they leave the frame showing the previous page.
   DCHECK(response);
@@ -376,6 +379,8 @@ void NavigationRequest::OnResponseStarted(
        response->head.headers->response_code() == 205)) {
     frame_tree_node_->navigator()->DiscardPendingEntryIfNeeded(
         navigation_handle_.get());
+    navigation_handle_->AbortCommit(render_frame_host,
+                                    response->head.headers);
     frame_tree_node_->ResetNavigationRequest(false);
     return;
   }
@@ -399,8 +404,6 @@ void NavigationRequest::OnResponseStarted(
     common_params_.lofi_state = LOFI_OFF;
 
   // Select an appropriate renderer to commit the navigation.
-  RenderFrameHostImpl* render_frame_host =
-      frame_tree_node_->render_manager()->GetFrameHostForNavigation(*this);
   NavigatorImpl::CheckWebUIRendererDoesNotDisplayNormalURL(render_frame_host,
                                                            common_params_.url);