To fix the cross-site post submission bug.

content/public/browser/navigation_entry.h

Index: content/public/browser/navigation_entry.h
diff --git a/content/public/browser/navigation_entry.h b/content/public/browser/navigation_entry.h
index 63af6871b20e202b7d796960e9d298c9d86e2a35..67015d276aa3ddb81a01c3bfe02e04162cf0dd07 100644
--- a/content/public/browser/navigation_entry.h
+++ b/content/public/browser/navigation_entry.h
@@ -7,13 +7,13 @@
 
 #include <string>
 
-#include "base/memory/ref_counted_memory.h"
 #include "base/string16.h"
 #include "base/time.h"
 #include "content/common/content_export.h"
 #include "content/public/common/page_transition_types.h"
 #include "content/public/common/page_type.h"
 #include "content/public/common/referrer.h"
+#include "webkit/glue/resource_request_body.h"
 
 class GURL;
 
@@ -131,6 +131,10 @@ class NavigationEntry {
   // 1) browser_initiated_post_data when a new post data request is started.
   // 2) content_state when a post request has started and is extracted by
   //    WebKit to actually make the request.
+  //
+  // For the Cross-Process POST navigation, this flag is still true but
+  // the browser_initiated_post_data is pointed to an invalid address
+  // in the swapped-out process. Make sure to check the pointer before use it.
   virtual void SetHasPostData(bool has_post_data) = 0;
   virtual bool GetHasPostData() const = 0;
 
@@ -146,8 +150,9 @@ class NavigationEntry {
   // 2) is shallow copied with the static copy Create method above.
   // 3) may be NULL so check before use.
   virtual void SetBrowserInitiatedPostData(
-      const base::RefCountedMemory* data) = 0;
-  virtual const base::RefCountedMemory* GetBrowserInitiatedPostData() const = 0;
+      scoped_refptr<webkit_glue::ResourceRequestBody> data) = 0;
+  virtual const scoped_refptr<webkit_glue::ResourceRequestBody>
+      GetBrowserInitiatedPostData() const = 0;
 
   // The favicon data and tracking information. See content::FaviconStatus.
   virtual const FaviconStatus& GetFavicon() const = 0;