Clone the subframe FrameNavigationEntries for in-page navigations.

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index e447c0e24c998ad9f629885282f1963b6fc29e23..cd17bdac9c68fd0d40e80855a8aa196d2c332a3f 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -847,7 +847,8 @@ bool NavigationControllerImpl::RendererDidNavigate(
 
   switch (details->type) {
     case NAVIGATION_TYPE_NEW_PAGE:
-      RendererDidNavigateToNewPage(rfh, params, details->did_replace_entry);
+      RendererDidNavigateToNewPage(rfh, params, details->is_in_page,
+                                   details->did_replace_entry);
       break;
     case NAVIGATION_TYPE_EXISTING_PAGE:
       details->did_replace_entry = details->is_in_page;
@@ -857,7 +858,7 @@ bool NavigationControllerImpl::RendererDidNavigate(
       RendererDidNavigateToSamePage(rfh, params);
       break;
     case NAVIGATION_TYPE_NEW_SUBFRAME:
-      RendererDidNavigateNewSubframe(rfh, params);
+      RendererDidNavigateNewSubframe(rfh, params, details->is_in_page);
       break;
     case NAVIGATION_TYPE_AUTO_SUBFRAME:
       if (!RendererDidNavigateAutoSubframe(rfh, params))
@@ -1052,6 +1053,7 @@ NavigationType NavigationControllerImpl::ClassifyNavigation(
 void NavigationControllerImpl::RendererDidNavigateToNewPage(
     RenderFrameHostImpl* rfh,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+    bool is_in_page,
     bool replace_entry) {
   scoped_ptr<NavigationEntryImpl> new_entry;
   bool update_virtual_url;
@@ -1086,6 +1088,18 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
     update_virtual_url = needs_update;
   }
 
+  CHECK_EQ(0U, new_entry->root_node()->children.size());
+  if (SiteIsolationPolicy::UseSubframeNavigationEntries() && is_in_page) {
+    // Clone the tree of FrameNavigationEntries from the last committed entry.
+    // TODO(creis): Can we do this more cleanly as a clone of the whole last
+    // committed entry?
+    // TODO(creis): What about in-page navigations with no last committed entry,
+    // like pushState on the initial about:blank page?
+    new_entry->set_root_node(
+        GetLastCommittedEntry()->root_node()->CloneAndReplace(nullptr, nullptr,
+                                                              is_in_page));
+  }
+
   // Don't use the page type from the pending entry. Some interstitial page
   // may have set the type to interstitial. Once we commit, however, the page
   // type must always be normal or error.
@@ -1223,7 +1237,8 @@ void NavigationControllerImpl::RendererDidNavigateToSamePage(
 
 void NavigationControllerImpl::RendererDidNavigateNewSubframe(
     RenderFrameHostImpl* rfh,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
+    const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+    bool is_in_page) {
   DCHECK(ui::PageTransitionCoreTypeIs(params.transition,
                                       ui::PAGE_TRANSITION_MANUAL_SUBFRAME));
 
@@ -1242,7 +1257,8 @@ void NavigationControllerImpl::RendererDidNavigateNewSubframe(
         params.item_sequence_number, params.document_sequence_number,
         rfh->GetSiteInstance(), params.url, params.referrer);
     new_entry = GetLastCommittedEntry()->CloneAndReplace(rfh->frame_tree_node(),
-                                                         frame_entry);
+                                                         frame_entry,
+                                                         is_in_page);
     CHECK(frame_entry->HasOneRef());
   } else {
     new_entry = GetLastCommittedEntry()->Clone();