DocumentLoader: remove CancelClientNavigaiton call

This call does supposedly cancel client navigation, while in reality
it does not, since there is no client navigation happening just yet.
See fragment-change-does-not-cancel-pending-navigation.html which
exhibits this behavior.

Bug: none
Change-Id: If474156d4e2ebddc8c2129bd2173aa1713345ea2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1805248
Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#696930}

third_party/blink/renderer/core/loader/document_loader.cc

@@ -978,12 +978,9 @@ void DocumentLoader::CommitSameDocumentNavigationInternal(
 
   // If we have a provisional request for a different document, a fragment
   // scroll should cancel it.
+  // Note: see fragment-change-does-not-cancel-pending-navigation, where
+  // this does not actually happen.
   GetFrameLoader().DetachProvisionalDocumentLoader();
-  // TODO(dgozman): despite the comment above, next call does not actually
-  // cancel client navigation. See
-  // fragment-change-does-not-cancel-pending-navigation test. We should remove
-  // this call.
-  GetFrameLoader().CancelClientNavigation();
   GetFrameLoader().DidFinishNavigation(
       FrameLoader::NavigationFinishState::kSuccess);
 

third_party/blink/web_tests/compositing/overflow/do-not-crash-use-after-free-update-widget-positions.html

@@ -36,6 +36,8 @@
   }
 
   function iframeOnLoad() {
+    w3Iframe.onload = undefined;
+
     bodyElement.appendChild(acronymElement);
     acronymElement.offsetWidth;