Don't swap out the old RenderFrameHost until the new one commits.

content/browser/loader/resource_dispatcher_host_impl.cc

Index: content/browser/loader/resource_dispatcher_host_impl.cc
diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc
index f63b7cf8679baee8b0b0d3bf6dab0496f1c12860..b5d8a43b870ab9444293502fa9266f9790e61204 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.cc
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc
@@ -1407,12 +1407,9 @@ void ResourceDispatcherHostImpl::CancelTransferringNavigation(
 void ResourceDispatcherHostImpl::ResumeDeferredNavigation(
     const GlobalRequestID& id) {
   ResourceLoader* loader = GetLoader(id);
-  if (loader) {
-    // The response we were meant to resume could have already been canceled.
-    ResourceRequestInfoImpl* info = loader->GetRequestInfo();
-    if (info->cross_site_handler())
-      info->cross_site_handler()->ResumeResponse();
-  }
+  // The response we were meant to resume could have already been canceled.
+  if (loader)
+    loader->CompleteTransfer();

[Charlie Reis, 2014/08/18 23:27:53]

Note: We now only use this for transfers that end up not needing a new process. 
This means we can "complete" the transfer without changing any of the request's
metadata.

[nasko, 2014/08/19 16:45:23]

Converting to this doesn't remove the cross_site_handler() on the
ResourceRequestInfo object. Is this ok?
Also, if we complete here, does that work fine for the transition navigations?
They rely on the cross-site resource handler to pause the navigation through a
defer/resume.

[Charlie Reis, 2014/08/19 21:20:31]

I think the sole difference is that we set loader->is_transferring_ to false
before calling cross_site_handler()->ResumeResponse().  That should still remove
it from the info object.
I *think* their pause and resume logic should continue to work, since they have
a similar set of operations as transfers.  I admit that I don't have full
knowledge of what they're relying on CSRH for, but I didn't see any test
failures from the change.

 }
 
 // The object died, so cancel and detach all requests associated with it except