Kill vestigial transfer requests

content/browser/frame_host/navigation_handle_impl.cc

Index: content/browser/frame_host/navigation_handle_impl.cc
diff --git a/content/browser/frame_host/navigation_handle_impl.cc b/content/browser/frame_host/navigation_handle_impl.cc
index f2b2f133ddb19e898c42a356464ef428bd77a875..ae9e5dbe57a7670f7f2835d180ace81f6c679869 100644
--- a/content/browser/frame_host/navigation_handle_impl.cc
+++ b/content/browser/frame_host/navigation_handle_impl.cc
@@ -13,6 +13,7 @@
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/navigator_delegate.h"
+#include "content/browser/loader/resource_dispatcher_host_impl.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/service_worker/service_worker_navigation_handle.h"
 #include "content/common/frame_messages.h"
@@ -38,6 +39,12 @@ void UpdateThrottleCheckResult(
   *to_update = result;
 }
 
+void NotifyAbandonedTransferNavigation(const GlobalRequestID& id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  if (ResourceDispatcherHostImpl* rdh = ResourceDispatcherHostImpl::Get())
+    rdh->CancelRequest(id.child_id, id.request_id);
+}
+
 }  // namespace
 
 // static
@@ -105,6 +112,15 @@ NavigationHandleImpl::NavigationHandleImpl(
 }
 
 NavigationHandleImpl::~NavigationHandleImpl() {
+  // Transfer requests that have not matched up with another navigation request
+  // from the renderer need to be cleaned up. These are marked as protected in
+  // the RDHI, so they do not get cancelled when frames are destroyed.
+  if (is_transferring()) {
+    BrowserThread::PostTask(
+        BrowserThread::IO, FROM_HERE,
+        base::Bind(&NotifyAbandonedTransferNavigation, GetGlobalRequestID()));
+  }
+
   if (!IsRendererDebugURL(url_))
     GetDelegate()->DidFinishNavigation(this);