Avoid use-after-free when InterstitialPageImpl is being torn down.

content/browser/frame_host/interstitial_page_navigator_impl.h

Index: content/browser/frame_host/interstitial_page_navigator_impl.h
diff --git a/content/browser/frame_host/interstitial_page_navigator_impl.h b/content/browser/frame_host/interstitial_page_navigator_impl.h
index f0f8f32a12f0ddc1f59760f6b00bf3cc10806bda..6eed5a5953de3baca3866b9663f1279d850190a7 100644
--- a/content/browser/frame_host/interstitial_page_navigator_impl.h
+++ b/content/browser/frame_host/interstitial_page_navigator_impl.h
@@ -24,6 +24,7 @@ class CONTENT_EXPORT InterstitialPageNavigatorImpl : public Navigator {
       InterstitialPageImpl* interstitial,
       NavigationControllerImpl* navigation_controller);
 
+  // Navigator implementation.
   NavigatorDelegate* GetDelegate() override;
   NavigationController* GetController() override;
   void DidStartProvisionalLoad(
@@ -36,6 +37,10 @@ class CONTENT_EXPORT InterstitialPageNavigatorImpl : public Navigator {
       const FrameHostMsg_DidCommitProvisionalLoad_Params& input_params,
       std::unique_ptr<NavigationHandleImpl> navigation_handle) override;
 
+  // Disables any further action when the interstitial page is preparing to
+  // delete itself.
+  void Disable();
+
  private:
   ~InterstitialPageNavigatorImpl() override;
 
@@ -46,6 +51,10 @@ class CONTENT_EXPORT InterstitialPageNavigatorImpl : public Navigator {
   // The NavigationController associated with this navigator.
   NavigationControllerImpl* controller_;
 
+  // Whether this interstitial is still enabled.  Becomes false when the
+  // interstitial page is asychronously deleting itself.
+  bool enabled_;
+
   DISALLOW_COPY_AND_ASSIGN(InterstitialPageNavigatorImpl);
 };