Do not reset NavigationHandle when navigating same-page

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 781 matching lines @@
   // Update the data source's request with the new URL to fake the URL change
   m_frame->document()->setURL(newURL);
   documentLoader()->setReplacesCurrentHistoryItem(type !=
                                                   FrameLoadTypeStandard);
   documentLoader()->updateForSameDocumentNavigation(
       newURL, sameDocumentNavigationSource);
 
   // Generate start and stop notifications only when loader is completed so that
   // we don't fire them for fragment redirection that happens in window.onload
   // handler. See https://bugs.webkit.org/show_bug.cgi?id=31838
-  if (m_frame->document()->loadEventFinished())
+  // Do not fire the notifications if the frame is concurrently navigating away
+  // from the document, since a new document is already loading.
+  if (m_frame->document()->loadEventFinished() && !m_provisionalDocumentLoader)
     client()->didStartLoading(NavigationWithinSameDocument);
 
   HistoryCommitType historyCommitType = loadTypeToCommitType(type);
   if (!m_currentItem)
     historyCommitType = HistoryInertCommit;
   if (m_frame->settings()->historyEntryRequiresUserGesture() &&
       initiatingDocument && !initiatingDocument->hasReceivedUserGesture()) {
     historyCommitType = HistoryInertCommit;
   }
 
   setHistoryItemStateForCommit(
       type, historyCommitType,
       sameDocumentNavigationSource == SameDocumentNavigationHistoryApi
           ? HistoryNavigationType::HistoryApi
           : HistoryNavigationType::Fragment);
   if (sameDocumentNavigationSource == SameDocumentNavigationHistoryApi) {
     m_currentItem->setStateObject(std::move(data));
     m_currentItem->setScrollRestorationType(scrollRestorationType);
   }
   client()->dispatchDidNavigateWithinPage(
       m_currentItem.get(), historyCommitType, !!initiatingDocument);
   client()->dispatchDidReceiveTitle(m_frame->document()->title());
-  if (m_frame->document()->loadEventFinished())
+  if (m_frame->document()->loadEventFinished() && !m_provisionalDocumentLoader)
     client()->didStopLoading();
 }
 
 void FrameLoader::detachDocumentLoader(Member<DocumentLoader>& loader) {
   if (!loader)
     return;
 
   FrameNavigationDisabler navigationDisabler(*m_frame);
   loader->detachFromFrame();
   loader = nullptr;
@@ skipping 1114 matching lines @@
                          m_documentLoader ? m_documentLoader->url() : String());
   return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const {
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this,
                                       toTracedValue());
 }
 
 }  // namespace blink