GitLab

Currently, the FrameTreeNode destructor ensures that its
navigation_request_ is cleared, but does not ensure that navigation
has been cancelled for any of the other criteria it uses to determine
that it is loading. Ensure that the current and speculative
RenderFrameHostImpls are reset as well.

Many tests tear down a WebContentsImpl without ensuring that it is
done loading, and that is benign. However, it is possible to get a
situation where a subframe FrameTreeNode is detached while still
loading. If it is the last frame loading, this will cause the
FrameTree to transition from loading to not loading without an
associated DidStopLoading() callback.
WebContentsObserverSanityChecker DCHECKs on the rare case where
that happens.

Bug: 916413, 795479
Change-Id: I5abed2648dba2eb99db66a222b4fb5a22d594612
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1455110
Commit-Queue: Nate Chapin <japhet@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Auto-Submit: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#637846}