Fixes for Safe Browsing with unrelated pending navigations.

chrome/browser/safe_browsing/client_side_detection_host.cc

Index: chrome/browser/safe_browsing/client_side_detection_host.cc
diff --git a/chrome/browser/safe_browsing/client_side_detection_host.cc b/chrome/browser/safe_browsing/client_side_detection_host.cc
index ef73fb4f7265b6025066d1d1a4cf19a19d84220b..c3bab713836711f4e477123eec7b57d64ebc8113 100644
--- a/chrome/browser/safe_browsing/client_side_detection_host.cc
+++ b/chrome/browser/safe_browsing/client_side_detection_host.cc
@@ -405,7 +405,7 @@ void ClientSideDetectionHost::DidNavigateMainFrame(
 
 void ClientSideDetectionHost::OnSafeBrowsingHit(
     const SafeBrowsingUIManager::UnsafeResource& resource) {
-  if (!web_contents() || !web_contents()->GetController().GetActiveEntry())
+  if (!web_contents())
     return;
 
   // Check that the hit is either malware or phishing.
@@ -420,9 +420,12 @@ void ClientSideDetectionHost::OnSafeBrowsingHit(
       web_contents() != content::WebContents::FromRenderViewHost(hit_rvh))
     return;
 
+  NavigationEntry *entry = resource.GetNavigationEntryForResource();
+  if (!entry)
+    return;
+
   // Store the unique page ID for later.
-  unsafe_unique_page_id_ =
-      web_contents()->GetController().GetActiveEntry()->GetUniqueID();
+  unsafe_unique_page_id_ = entry->GetUniqueID();
 
   // We also keep the resource around in order to be able to send the
   // malicious URL to the server.
@@ -673,8 +676,14 @@ bool ClientSideDetectionHost::DidShowSBInterstitial() const {
   if (unsafe_unique_page_id_ <= 0 || !web_contents()) {
     return false;
   }
+  // DidShowSBInterstitial is called after client side detection is finished to
+  // see if a SB interstitial was shown on the same page. Client Side Detection
+  // only runs on the currently committed page, so an unconditional
+  // GetLastCommittedEntry is correct here. GetNavigationEntryForResource cannot
+  // be used since it may no longer by valid (eg, if the UnsafeResource was for

[Charlie Reis, 2015/12/17 19:24:18]

nit: s/by/be/

[mattm, 2015/12/18 21:41:04]

Done.

+  // a blocking main page load which was then proceeded through).
   const NavigationEntry* nav_entry =
-      web_contents()->GetController().GetActiveEntry();
+      web_contents()->GetController().GetLastCommittedEntry();
   return (nav_entry && nav_entry->GetUniqueID() == unsafe_unique_page_id_);
 }