Change BrowsingInstance when changing WebUI type.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index dc76abd1ca480a5bf233dff67dadbef6122dbfe5..f2f5ffd0c511d68bd4656d62eb2fe71cd1b6264d 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -1245,8 +1245,12 @@ bool RenderFrameHostManager::ShouldSwapBrowsingInstancesForNavigation(
   if (IsRendererDebugURL(new_effective_url))
     return false;
 
+  // about:blank should be safe to load in any BrowsingInstance.
+  if (new_effective_url == GURL(url::kAboutBlankURL))
+    return false;
+
   // For security, we should transition between processes when one is a Web UI
-  // page and one isn't.
+  // page and one isn't, or if the WebUI types differ.
   if (ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
           render_frame_host_->GetProcess()->GetID()) ||
       WebUIControllerFactoryRegistry::GetInstance()->UseWebUIForURL(
@@ -1257,6 +1261,15 @@ bool RenderFrameHostManager::ShouldSwapBrowsingInstancesForNavigation(
             browser_context, new_effective_url)) {
       return true;
     }
+
+    // Force swap if the current WebUI type differs from the one for the
+    // destination.
+    if (WebUIControllerFactoryRegistry::GetInstance()->GetWebUIType(
+            browser_context, current_effective_url) !=
+        WebUIControllerFactoryRegistry::GetInstance()->GetWebUIType(
+            browser_context, new_effective_url)) {
+      return true;
+    }
   } else {
     // Force a swap if it's a Web UI URL.
     if (WebUIControllerFactoryRegistry::GetInstance()->UseWebUIForURL(