The difference that's causing this is that in CRWWebController.loadCurrentURLInNativeView, finishLoadCurrentURLInNativeView (and hence controllerForURL) is called immediately when using the LegacyNavigationManager, but called asynchronously as a completion handler when using WKBasedNavigationManager. The problem is that when didFinishNavigation gets called, we find a completion handler based on the URL of the navigation that finished, but then finishLoadCurrentURLInNativeView assumes the currentNavItem corresponds to the navigation that just finished (which would of course be true when finishLoadCurrentURLInNativeView gets called synchronously, but isn't necessarily true when called async since another navigation could have started already).

Would it make sense to change didFinishNavigation to compare the URL for the navigation to the placeholder URL for the current item, and if they don't match just abort? So something like:

      web::NavigationItem* item = self.currentNavItem;
      if (CreatePlaceholderUrlForUrl(item->GetVirtualURL()) != webViewURL)
          return;

Changing the tests works too (see crrev.com/c/736142) if changing didFinishNavigation doesn't make sense.

Yes comparing placeholder URL to the current item and abort should work. Can you add a new test to crw_web_controller_unittest to test this race scenario You need to manually trigger WKNavigationDelegate callbacks to simulate the interleaving. See CRWWebControllerTest/CurrentUrlWithTrustLevel for an example.

It doesn't look like the intent of the original test in this bug is trying to test navigation history. So I don't think we need to add any wait-for-load-completion logic to the test. The abort you add should fix the test.

 Issue 780828  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/54d8c4e9d04cd19765991ea87bfc56f998f5908d

commit 54d8c4e9d04cd19765991ea87bfc56f998f5908d
Author: Ali Juma <ajuma@chromium.org>
Date: Mon Nov 27 20:22:42 2017

[Nav Experiment] Abort native URL navigation if new navigation starts

With LegacyNavigationManagerImpl, native URLs are loaded synchronously
during the call to CRWWebController.loadCurrentURL, so it's impossible
for another navigation to start before the native URL navigation finishes.

With WKBasedNavigationManager, the call to loadCurrentURL triggers an
placeholder navigation on the WKWebView, and the actual work to load the
native URL happens when that placeholder navigation is finished. Since
the placeholder navigation happens asynchronously, a new navigation
(creating a new pending navigation item) can start before the placeholder
navigation finishes. In this situation, when the placeholder navigation
finishes, running its completion handler to load the native URL results
in incorrect behavior and a DCHECK, since the current navigation item
(the new one) no longer corresponds to that native URL navigation.

This CL skips running the completion handler for a placeholder navigation
when another navigation has started. This means that a WebStateObserver
sees neither a DidStartNavigation call nor a DidFinishNavigation call
for the native URL navigation.

This fixes crashes in several tests when loading a URL after opening a
new tab, when using WKBasedNavigationManager.

Bug:  775645 
Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
Change-Id: I88ce3f524ca4298ad5905430c12dca759a9b7202
Reviewed-on: https://chromium-review.googlesource.com/788173
Commit-Queue: Ali Juma <ajuma@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#519382}
[modify] https://crrev.com/54d8c4e9d04cd19765991ea87bfc56f998f5908d/ios/web/public/test/fakes/test_native_content_provider.mm
[modify] https://crrev.com/54d8c4e9d04cd19765991ea87bfc56f998f5908d/ios/web/web_state/ui/crw_web_controller.mm
[modify] https://crrev.com/54d8c4e9d04cd19765991ea87bfc56f998f5908d/ios/web/web_state/ui/crw_web_controller_unittest.mm

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1f1659366389e11e962f770e28156e7892afcb70

commit 1f1659366389e11e962f770e28156e7892afcb70
Author: Olivier Robin <olivierrobin@chromium.org>
Date: Tue Nov 28 10:05:04 2017

Revert "[Nav Experiment] Abort native URL navigation if new navigation starts"

This reverts commit 54d8c4e9d04cd19765991ea87bfc56f998f5908d.

Reason for revert: CRWWebControllerTest.SslCertError fails consistently on device.

Original change's description:
> [Nav Experiment] Abort native URL navigation if new navigation starts
> 
> With LegacyNavigationManagerImpl, native URLs are loaded synchronously
> during the call to CRWWebController.loadCurrentURL, so it's impossible
> for another navigation to start before the native URL navigation finishes.
> 
> With WKBasedNavigationManager, the call to loadCurrentURL triggers an
> placeholder navigation on the WKWebView, and the actual work to load the
> native URL happens when that placeholder navigation is finished. Since
> the placeholder navigation happens asynchronously, a new navigation
> (creating a new pending navigation item) can start before the placeholder
> navigation finishes. In this situation, when the placeholder navigation
> finishes, running its completion handler to load the native URL results
> in incorrect behavior and a DCHECK, since the current navigation item
> (the new one) no longer corresponds to that native URL navigation.
> 
> This CL skips running the completion handler for a placeholder navigation
> when another navigation has started. This means that a WebStateObserver
> sees neither a DidStartNavigation call nor a DidFinishNavigation call
> for the native URL navigation.
> 
> This fixes crashes in several tests when loading a URL after opening a
> new tab, when using WKBasedNavigationManager.
> 
> Bug:  775645 
> Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
> Change-Id: I88ce3f524ca4298ad5905430c12dca759a9b7202
> Reviewed-on: https://chromium-review.googlesource.com/788173
> Commit-Queue: Ali Juma <ajuma@chromium.org>
> Reviewed-by: Eugene But <eugenebut@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#519382}

TBR=ajuma@chromium.org,eugenebut@chromium.org,danyao@chromium.org

Change-Id: I0dee4db324947553e1c9b6c8d480f9eda3981644
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  775645 
Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
Reviewed-on: https://chromium-review.googlesource.com/792990
Reviewed-by: Olivier Robin <olivierrobin@chromium.org>
Commit-Queue: Olivier Robin <olivierrobin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#519634}
[modify] https://crrev.com/1f1659366389e11e962f770e28156e7892afcb70/ios/web/public/test/fakes/test_native_content_provider.mm
[modify] https://crrev.com/1f1659366389e11e962f770e28156e7892afcb70/ios/web/web_state/ui/crw_web_controller.mm
[modify] https://crrev.com/1f1659366389e11e962f770e28156e7892afcb70/ios/web/web_state/ui/crw_web_controller_unittest.mm

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a0c53c28fe7bebfe8c19d69c30fd30628b77c337

commit a0c53c28fe7bebfe8c19d69c30fd30628b77c337
Author: Danyao Wang <danyao@google.com>
Date: Wed Nov 29 23:25:49 2017

Reland "[Nav Experiment] Abort native URL navigation"

The original CL caused a crash in CRWWebControllerTest.SslCertError in
release build. The temporary NSURL created in SetWebViewURL() went out
of scope when accessed. The fix is to store NSURL as a class member.

This is a reland of 54d8c4e9d04cd19765991ea87bfc56f998f5908d

Original change's description:
> [Nav Experiment] Abort native URL navigation if new navigation starts
>
> With LegacyNavigationManagerImpl, native URLs are loaded synchronously
> during the call to CRWWebController.loadCurrentURL, so it's impossible
> for another navigation to start before the native URL navigation finishes.
>
> With WKBasedNavigationManager, the call to loadCurrentURL triggers an
> placeholder navigation on the WKWebView, and the actual work to load the
> native URL happens when that placeholder navigation is finished. Since
> the placeholder navigation happens asynchronously, a new navigation
> (creating a new pending navigation item) can start before the placeholder
> navigation finishes. In this situation, when the placeholder navigation
> finishes, running its completion handler to load the native URL results
> in incorrect behavior and a DCHECK, since the current navigation item
> (the new one) no longer corresponds to that native URL navigation.
>
> This CL skips running the completion handler for a placeholder navigation
> when another navigation has started. This means that a WebStateObserver
> sees neither a DidStartNavigation call nor a DidFinishNavigation call
> for the native URL navigation.
>
> This fixes crashes in several tests when loading a URL after opening a
> new tab, when using WKBasedNavigationManager.
>
> Bug:  775645 
> Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
> Change-Id: I88ce3f524ca4298ad5905430c12dca759a9b7202
> Reviewed-on: https://chromium-review.googlesource.com/788173
> Commit-Queue: Ali Juma <ajuma@chromium.org>
> Reviewed-by: Eugene But <eugenebut@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#519382}

Bug:  775645 ,  789175 
Change-Id: If168be04f8fa85a0b4919f881edbe67794883d7f
Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
Reviewed-on: https://chromium-review.googlesource.com/794150
Reviewed-by: Eugene But <eugenebut@chromium.org>
Commit-Queue: Danyao Wang <danyao@chromium.org>
Cr-Commit-Position: refs/heads/master@{#520302}
[modify] https://crrev.com/a0c53c28fe7bebfe8c19d69c30fd30628b77c337/ios/web/public/test/fakes/test_native_content_provider.mm
[modify] https://crrev.com/a0c53c28fe7bebfe8c19d69c30fd30628b77c337/ios/web/web_state/ui/crw_web_controller.mm
[modify] https://crrev.com/a0c53c28fe7bebfe8c19d69c30fd30628b77c337/ios/web/web_state/ui/crw_web_controller_unittest.mm