GitLab

AbortClientNavigation() resets the navigation client message pipe, so it
is impossible to be in a state where the navigation client message pipe
is still connected but the commit should be ignored.

Unfortunately, this doesn't mean that the race previously fixed in
https://crbug.com/763106 is gone. It just means that the browser process
can send a CommitNavigation() that the renderer will never hear about
because the renderer's endpoint is already gone.

There is one tricky case with CommitNavigationWithParams(), which
previously also checked if the commit should be ignored. This method is
asynchronously called by MHTMLBodyLoaderClient when the MHTML archive
body is fully loaded. However, since MHTMLBodyLoaderClient is reset with
the same timing as the navigation client message pipe, this turns out
not to be a problem in practice.

Bug: 1020175
Change-Id: I3a8dc816030071a30f315ebc62a819ef3cde143a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2493669
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#820307}