Fix use-after-free in NavigationSimulator test util

content/public/test/navigation_simulator.cc

Index: content/public/test/navigation_simulator.cc
diff --git a/content/public/test/navigation_simulator.cc b/content/public/test/navigation_simulator.cc
index daf4cfb9b28e43afa5a8c264558fa853a4c2e410..ffd2485f1f77af393490e4717780544621a65769 100644
--- a/content/public/test/navigation_simulator.cc
+++ b/content/public/test/navigation_simulator.cc
@@ -230,6 +230,11 @@ void NavigationSimulator::Commit() {
   if (IsBrowserSideNavigationEnabled() &&
       render_frame_host_->frame_tree_node()->navigation_request()) {
     render_frame_host_->PrepareForCommit();
+    // Synchronous failure can cause the navigation to finish here.
+    if (!handle_) {
+      state_ = FAILED;
+      return;
+    }
   }
 
   // Call NavigationHandle::WillProcessResponse if needed.
@@ -508,8 +513,10 @@ void NavigationSimulator::ReadyToCommitNavigation(
 
 void NavigationSimulator::DidFinishNavigation(
     NavigationHandle* navigation_handle) {
-  if (navigation_handle == handle_)
+  if (navigation_handle == handle_) {
     num_did_finish_navigation_called_++;
+    handle_ = nullptr;
+  }
 }
 
 void NavigationSimulator::OnWillStartRequest() {