Delete the NavigationURLLoader when its jobs ends.

The NavigationURLLoader isn't supposed to call the NavigationRequest
anymore after forwarding the URLLoaderClient in OnResponseStarted or
after failing in OnRequestFailed.

This deletes the NavigationURLLoader to ensure the NavigationRequest
won't receives any call anymore after that.

Bug: 936962
Change-Id: I37e3fe6b1b7d9ff74a6e01d49b80a734d9b5a305
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1503135Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Camille Lamy <clamy@chromium.org>
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#638168}

content/browser/frame_host/navigation_request.cc

@@ -1058,6 +1058,9 @@ void NavigationRequest::OnResponseStarted(
     NavigationDownloadPolicy download_policy,
     bool is_stream,
     base::Optional<SubresourceLoaderParams> subresource_loader_params) {
+  // The |loader_|'s job is finished. It must not call the NavigationRequest
+  // anymore from now.
+  loader_ = nullptr;
   is_download_ = is_download && IsNavigationDownloadAllowed(download_policy);
   is_stream_ = is_stream;
   request_id_ = request_id;
@@ -1285,6 +1288,11 @@ void NavigationRequest::OnResponseStarted(
 void NavigationRequest::OnRequestFailed(
     const network::URLLoaderCompletionStatus& status) {
   DCHECK_NE(status.error_code, net::OK);
+
+  // The |loader_|'s job is finished. It must not call the NavigationRequest
+  // anymore from now.
+  loader_ = nullptr;
+
   bool collapse_frame =
       status.extended_error_code ==
       static_cast<int>(blink::ResourceRequestBlockedReason::kCollapsedByClient);