PlzNavigate: Fix the fast/loader/crash-replacing-location-before-load.html layout test.

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 846 matching lines @@
     FrameLoadType frameLoadType,
     HistoryLoadType historyLoadType,
     ClientRedirectPolicy clientRedirect,
     Document* initiatingDocument) {
   // If we have a state object, we cannot also be a new navigation.
   DCHECK(!stateObject || frameLoadType == FrameLoadTypeBackForward);
 
   // If we have a provisional request for a different document, a fragment
   // scroll should cancel it.
   detachDocumentLoader(m_provisionalDocumentLoader);
+
+  // PlzNavigate: A fragment scroll should clear ongoing client navigations.
+  clearNavigationHandledByClient();
+
   if (!m_frame->host())
     return;
   saveScrollState();
 
   KURL oldURL = m_frame->document()->url();
   bool hashChange = equalIgnoringFragmentIdentifier(url, oldURL) &&
                     url.fragmentIdentifier() != oldURL.fragmentIdentifier();
   if (hashChange) {
     // If we were in the autoscroll/middleClickAutoscroll mode we want to stop
     // it before following the link to the anchor
@@ skipping 1155 matching lines @@
   m_isNavigationHandledByClient = true;
   InspectorInstrumentation::frameScheduledClientNavigation(m_frame);
 }
 
 void FrameLoader::clearNavigationHandledByClient() {
   m_isNavigationHandledByClient = false;
   InspectorInstrumentation::frameClearedScheduledClientNavigation(m_frame);
 }
 
 }  // namespace blink