Don't use pending NavigationEntries for navigation transfers.

content/browser/frame_host/navigation_controller_impl_browsertest.cc

Index: content/browser/frame_host/navigation_controller_impl_browsertest.cc
diff --git a/content/browser/frame_host/navigation_controller_impl_browsertest.cc b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
index cf9c8c79ecf8fda878cea954f280ea01daf508e6..a6aef93555b1e3c66be8b3febefcc3bca5261bc6 100644
--- a/content/browser/frame_host/navigation_controller_impl_browsertest.cc
+++ b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
@@ -507,12 +507,13 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, SubframeOnEmptyPage) {
   ASSERT_EQ(1U, new_root->child_count());
   ASSERT_NE(nullptr, new_root->child_at(0));
 
-  // Navigate it.
+  // Navigate it cross-site.
   GURL frame_url = embedded_test_server()->GetURL(
-      "/navigation_controller/simple_page_2.html");
+      "foo.com", "/navigation_controller/simple_page_2.html");
   script = "location.assign('" + frame_url.spec() + "')";
   EXPECT_TRUE(content::ExecuteScript(
       new_root->child_at(0)->current_frame_host(), script));
+  WaitForLoadStopWithoutSuccessCheck(new_shell->web_contents());

[Charlie Reis, 2016/03/30 15:26:08]

Before the change in this CL, doing this crashes in LoadURLWithParams on the
GetLastCommittedEntry()->Clone() line (at least in OOPIF-enabled modes).  We
need the wait line to let the navigation get to the transfer and thus crash.

In fact, I realized this bug surfaces as crashes in
content::NavigationEntryImpl::CloneAndReplace, which is
https://crbug.com/584739.  So this should be a useful crash fix after all!

[alexmos, 2016/03/30 16:50:41]

Nice!

 
   // Success is not crashing, and not navigating.
   EXPECT_EQ(nullptr,