Fix race when reloading original URL

content/browser/frame_host/navigation_entry_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_entry_impl.h"
 
 #include <queue>
 
 #include "base/metrics/histogram.h"
 #include "base/strings/string_util.h"
@@ skipping 428 matching lines @@
     FrameMsg_Navigate_Type::Value navigation_type) const {
   FrameMsg_UILoadMetricsReportType::Value report_type =
       FrameMsg_UILoadMetricsReportType::NO_REPORT;
   base::TimeTicks ui_timestamp = base::TimeTicks();
 #if defined(OS_ANDROID)
   if (!intent_received_timestamp().is_null())
     report_type = FrameMsg_UILoadMetricsReportType::REPORT_INTENT;
   ui_timestamp = intent_received_timestamp();
 #endif
 
+  GURL url = frame_entry.url();
+  Referrer referrer = frame_entry.referrer();
+  if (navigation_type == FrameMsg_Navigate_Type::RELOAD_ORIGINAL_REQUEST_URL &&
+      GetOriginalRequestURL().is_valid() && !GetHasPostData()) {
+    // We may have been redirected when navigating to the current URL.
+    // Use the URL the user originally intended to visit, if it's valid and if a
+    // POST wasn't involved; the latter case avoids issues with sending data to
+    // the wrong page.
+    url = GetOriginalRequestURL();
+    referrer = Referrer();
+  }
+
   return CommonNavigationParams(
-      frame_entry.url(), frame_entry.referrer(), GetTransitionType(),
-      navigation_type, !IsViewSourceMode(), ui_timestamp, report_type,
-      GetBaseURLForDataURL(), GetHistoryURLForDataURL());
+      url, referrer, GetTransitionType(), navigation_type, !IsViewSourceMode(),
+      ui_timestamp, report_type, GetBaseURLForDataURL(),
+      GetHistoryURLForDataURL());
 }
 
 StartNavigationParams NavigationEntryImpl::ConstructStartNavigationParams()
     const {
   std::vector<unsigned char> browser_initiated_post_data;
   if (GetBrowserInitiatedPostData()) {
     browser_initiated_post_data.assign(
         GetBrowserInitiatedPostData()->front(),
         GetBrowserInitiatedPostData()->front() +
             GetBrowserInitiatedPostData()->size());
@@ skipping 141 matching lines @@
       return node;
     }
     // Enqueue any children and keep looking.
     for (auto& child : node->children)
       work_queue.push(child);
   }
   return nullptr;
 }
 
 }  // namespace content