The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4efc08b53165c7cca522a5d0fcbd5639281f4906

commit 4efc08b53165c7cca522a5d0fcbd5639281f4906
Author: ananta <ananta@chromium.org>
Date: Fri Feb 24 23:01:43 2017

PlzNavigate: Fix the fast/loader/crash-replacing-location-before-load.html layout test.

This test creates an iframe and then initiates an anchor navigation to the frame. This eventually
goes through the location change code path which schedules a navigation to the anchor url.
With PlzNavigate the anchor navigation is sent to the browser and when the navigation commits
the FrameLoader::loadInSameDocument() function as the url being navigated to is the same as the main
frame url with the difference being the anchor tag.

We currently don't clear the member m_isNavigationHandledByClient in FrameLoader in this code path.
As a result we never mark the navigation as complete when the stack unwinds and hence the test ends up
waiting indefinitely.

Fix is to call FrameLoader::clearNavigationHandledByClient() in the loadInSameDocument() function which
ensures that the navigation is marked as complete correctly.

BUG=695435

Review-Url: https://codereview.chromium.org/2705373006
Cr-Commit-Position: refs/heads/master@{#452978}

[modify] https://crrev.com/4efc08b53165c7cca522a5d0fcbd5639281f4906/third_party/WebKit/LayoutTests/FlagExpectations/enable-browser-side-navigation
[modify] https://crrev.com/4efc08b53165c7cca522a5d0fcbd5639281f4906/third_party/WebKit/Source/core/loader/FrameLoader.cpp

Unassigning all bugs for ananta@chromium.org