Ensure that all code paths which call FrameTreeNode::ResetNavigationRequest set NavigationHandle::G…

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index eb178c47525eacfe64e6d983a256e13786472693..8ab2e551bde024f90f81605062548a4146eab23b 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -420,6 +420,7 @@ void RenderFrameHostManager::OnCrossSiteResponse(
   // If the NavigationHandle wasn't claimed, this will lead to the cancelation
   // of the request in the network stack.
   if (transfer_navigation_handle_) {
+    transfer_navigation_handle_->set_net_error_code(net::ERR_ABORTED);
     transfer_navigation_handle_->set_is_transferring(false);
     transfer_navigation_handle_.reset();
   }
@@ -1008,6 +1009,12 @@ void RenderFrameHostManager::CancelPendingIfNecessary(
   else if (render_frame_host == speculative_render_frame_host_.get()) {
     // TODO(nasko, clamy): This should just clean up the speculative RFH
     // without canceling the request.  See https://crbug.com/636119.
+    if (frame_tree_node_->navigation_request() &&
+        frame_tree_node_->navigation_request()->navigation_handle()) {
+      frame_tree_node_->navigation_request()
+          ->navigation_handle()
+          ->set_net_error_code(net::ERR_ABORTED);
+    }
     frame_tree_node_->ResetNavigationRequest(false, true);
   }
 }