I'm filing this as a follow-up issue to https://codereview.chromium.org/2226023003/.  In that CL, I'm changing both pending and speculative RFHs to be reset if their process dies before commit.  However, in the PlzNavigate case, I also had to clear the current navigation request [1], due to hitting the following DCHECK in NavigationRequest::OnStartChecksComplete in my new tests:

  RenderFrameHostImpl* navigating_frame_host =
      associated_site_instance_type_ == AssociatedSiteInstanceType::SPECULATIVE
          ? frame_tree_node_->render_manager()->speculative_frame_host()
          : frame_tree_node_->current_frame_host();
  DCHECK(navigating_frame_host);

Canceling the request shouldn't really be necessary.  Instead, we can probably check whether the speculative/current RFH died during the request and recreate the RFH accordingly.

[1] https://codereview.chromium.org/2226023003/diff/20001/content/browser/frame_host/render_frame_host_manager.cc#newcode1037