Ensure the NavigationHandle's nav entry ID is updated during transfers.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 812 matching lines @@
       entry->SetCanLoadLocalResources(params.can_load_local_resources);
       break;
     default:
       NOTREACHED();
       break;
   };
 
   LoadEntry(std::move(entry));
 }
 
+bool NavigationControllerImpl::PendingEntryMatchesHandle(
+    NavigationHandleImpl* handle) const {
+  return pending_entry_ &&
+         pending_entry_->GetUniqueID() == handle->pending_nav_entry_id();
+}
+
 bool NavigationControllerImpl::RendererDidNavigate(
     RenderFrameHostImpl* rfh,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
     LoadCommittedDetails* details) {
   is_initial_navigation_ = false;
 
   // Save the previous state before we clobber it.
   if (GetLastCommittedEntry()) {
     details->previous_url = GetLastCommittedEntry()->GetURL();
     details->previous_entry_index = GetLastCommittedEntryIndex();
   } else {
     details->previous_url = GURL();
     details->previous_entry_index = -1;
   }
 
   // If there is a pending entry at this point, it should have a SiteInstance,
   // except for restored entries.
   DCHECK(pending_entry_index_ == -1 ||
          pending_entry_->site_instance() ||
          pending_entry_->restore_type() != NavigationEntryImpl::RESTORE_NONE);
   if (pending_entry_ &&
       pending_entry_->restore_type() != NavigationEntryImpl::RESTORE_NONE)
     pending_entry_->set_restore_type(NavigationEntryImpl::RESTORE_NONE);
 
-  // If we are doing a cross-site reload, we need to replace the existing
-  // navigation entry, not add another entry to the history. This has the side
-  // effect of removing forward browsing history, if such existed. Or if we are
-  // doing a cross-site redirect navigation, we will do a similar thing.
+  // If the pending entry matches this commit, check if it says to replace the
+  // current entry (which preserves forward history).  This is used for things
+  // like cross-process location.replace and client redirects, as well as
+  // cross-process reloads (which can happen with embedder features like
+  // hosted apps).
   //
   // If this is an error load, we may have already removed the pending entry
   // when we got the notice of the load failure. If so, look at the copy of the
-  // pending parameters that were saved.
-  if (params.url_is_unreachable && failed_pending_entry_id_ != 0) {
+  // pending parameters that were saved and see if they match the handle.
+  NavigationHandleImpl* handle = rfh->navigation_handle();
+  DCHECK(handle);
+  if (params.url_is_unreachable && failed_pending_entry_id_ != 0 &&
+      handle->pending_nav_entry_id() == failed_pending_entry_id_) {
     details->did_replace_entry = failed_pending_entry_should_replace_;
+  } else if (PendingEntryMatchesHandle(handle) &&
+             pending_entry_->should_replace_entry()) {
+    details->did_replace_entry = pending_entry_->should_replace_entry();
   } else {
-    details->did_replace_entry = pending_entry_ &&
-                                 pending_entry_->should_replace_entry();
+    details->did_replace_entry = false;
   }
 
   // Do navigation-type specific actions. These will make and commit an entry.
   details->type = ClassifyNavigation(rfh, params);
 
   // is_in_page must be computed before the entry gets committed.
   details->is_in_page = IsURLInPageNavigation(
       params.url, params.was_within_same_page, rfh);
 
   switch (details->type) {
@@ skipping 222 matching lines @@
   // that was just loaded. Verify this by checking if the entry corresponds
   // to the current navigation handle. Note that in some tests the render frame
   // host does not have a valid handle. Additionally, coarsely check that:
   // 1. The SiteInstance hasn't been assigned to something else.
   // 2. The pending entry was intended as a new entry, rather than being a
   // history navigation that was interrupted by an unrelated,
   // renderer-initiated navigation.
   // TODO(csharrison): Investigate whether we can remove some of the coarser
   // checks.
   NavigationHandleImpl* handle = rfh->navigation_handle();
-  if (pending_entry_ && handle &&
-      handle->pending_nav_entry_id() == pending_entry_->GetUniqueID() &&
+  DCHECK(handle);
+  if (PendingEntryMatchesHandle(handle) &&
       pending_entry_index_ == -1 &&

[nasko, 2016/03/11 20:21:56]

nit: Wouldn't this fit on the previous line? git cl format might be helpful for
these types of fixes.

[Charlie Reis, 2016/03/11 21:11:37]

Done.

       (!pending_entry_->site_instance() ||
        pending_entry_->site_instance() == rfh->GetSiteInstance())) {
     new_entry = pending_entry_->Clone();
 
     update_virtual_url = new_entry->update_virtual_url_with_url();
   } else {
     new_entry = make_scoped_ptr(new NavigationEntryImpl);
 
     // Find out whether the new entry needs to update its virtual URL on URL
     // change and set up the entry accordingly. This is needed to correctly
@@ skipping 946 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content