Abort ongoing navigations when firing certain navigate events

In particular, when firing same-document (synchronous) push/replace navigate events, i.e., those originating from history.pushState()/replaceState(), or fragment navigations.

This fixes an assertion failure, and better aligns with Chromium's behavior (although, it does so while avoiding a crash bug that Chromium has).

Closes #11184.

Author: domenic

source

@@ -96854,6 +96854,45 @@ interface <dfn interface>NavigationDestination</dfn> {
   null):</p>
 
   <ol>
+   <li>
+    <p>If <var>isSameDocument</var> is true:</p>
+
+    <ol>
+     <li>
+      <p><span>While</span> <var>navigation</var>'s <span>ongoing <code
+      data-x="event-navigate">navigate</code> event</span> is not null:</p>
+
+      <ol>
+       <li><p><span>Abort the ongoing navigation</span> given <var>navigation</var>.</p></li>
+      </ol>
+
+      <div class="note">
+       <p>If there is an ongoing cross-document navigation, this means it will signaled to the
+       navigation API as aborted, e.g., by firing <code
+       data-x="event-navigateerror">navigateerror</code> events. This is somewhat accurate, since
+       the next navigation the <code>Document</code> experiences will be this same-document
+       navigation, so a developer which was expecting the next navigation completion to be that of
+       the cross-document navigation gets a useful signal that this did not happen. However, it is
+       also somewhat inaccurate, as the browser will continue to process the ongoing cross-document
+       navigation (applying it after this same-document one synchronously finishes).</p>
+
+       <p>Ultimately, the navigation API gets a bit messy with overlapping cross- and same-document
+       navigations, as the <a href="#ongoing-navigation-tracking">ongoing navigation tracking</a>
+       machinery and APIs are built to expose only a single ongoing navigation. Web developers will
+       be best-served if they do not create such overlapping situations, e.g., by <code
+       data-x="">await</code>ing promises returned from <code
+       data-x="dom-Navigation-navigate">navigation.navigate()</code> before starting new
+       navigations.</p>
+      </div>
+
+      <p class="note">This is a loop, since <span>abort the ongoing navigation</span> can run
+      JavaScript (e.g., via the <code data-x="event-navigateerror">navigateerror</code> event),
+      which might start a new navigation. Since such a newly-started navigation will be superseded
+      by the completion of this navigation, it gets signaled to the navigation API as aborted.</p>
+     </li>
+    </ol>
+   </li>
+
    <li><p>Let <var>event</var> be the result of <span>creating an event</span> given
    <code>NavigateEvent</code>, in <var>navigation</var>'s <span
    data-x="concept-relevant-realm">relevant realm</span>.</p></li>