Do not filter IPC messages until the new RVH commits, to avoid a race.

content/browser/tab_contents/tab_contents.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/tab_contents/tab_contents.h"
 
 #include <cmath>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
@@ skipping 85 matching lines @@
 //   to the current RVH.
 // - Once the onunload handler is finished, a SwapOut_ACK message is sent to
 //   the ResourceDispatcherHost, who unpauses the response.  Data is then sent
 //   to the pending RVH.
 // - The pending renderer sends a FrameNavigate message that invokes the
 //   DidNavigate method.  This replaces the current RVH with the
 //   pending RVH.
 // - The previous renderer is kept swapped out in RenderViewHostManager in case
 //   the user goes back.  The process only stays live if another tab is using
 //   it, but if so, the existing frame relationships will be maintained.
-//
-// It is possible that we trigger a new navigation after we have received
-// a SwapOut_ACK message but before the FrameNavigation has been confirmed.
-// In this case the old RVH has been swapped out but the new one has not
-// replaced it, yet. Therefore, we cancel the pending RVH and skip the unloading
-// of the old RVH.
 
 using content::DevToolsAgentHost;
 using content::DevToolsAgentHostRegistry;
 using content::DevToolsManagerImpl;
 using content::DownloadItem;
 using content::DownloadManager;
 using content::GlobalRequestID;
 using content::NavigationController;
 using content::NavigationEntry;
 using content::NavigationEntryImpl;
@@ skipping 2157 matching lines @@
   encoding_ = content::GetContentClient()->browser()->
       GetCanonicalEncodingNameByAliasName(encoding);
 }
 
 void TabContents::CreateViewAndSetSizeForRVH(RenderViewHost* rvh) {
   RenderWidgetHostView* rwh_view = GetView()->CreateViewForWidget(rvh);
   // Can be NULL during tests.
   if (rwh_view)
     rwh_view->SetSize(GetView()->GetContainerSize());
 }