We have checks to prevent a non-user initiated renderer-initiated navigation from cancelling a browser-initiated navigation. However, those rely on checking whether there is a NavigationRequest in the FrameTreeNode. When the browser-initiated navigation is cross-process, there is a window of time where the NavigationRequest is moved to a RFH so that the RFH commits it. If the RFH is a speculative one, the start of a new non-user navigation will delete it, cancelling the browser-initiated navigation. This should not happen.