Only use pending navigation params for browser-initiated navigations.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 75bb31eb4732ef4c141537b0b8d236f3bd05a214..d9811983f932ab43cde8471b188351135177db2c 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -2967,7 +2967,8 @@ void RenderFrameImpl::didCreateDataSource(blink::WebLocalFrame* frame,
 
   // The rest of RenderView assumes that a WebDataSource will always have a
   // non-null NavigationState.
-  UpdateNavigationState(document_state, false /* was_within_same_page */);
+  UpdateNavigationState(document_state, false /* was_within_same_page */,
+                        content_initiated);
 
   // DocumentState::referred_by_prefetcher_ is true if we are
   // navigating from a page that used prefetching using a link on that
@@ -3566,22 +3567,18 @@ void RenderFrameImpl::didFinishLoad(blink::WebLocalFrame* frame) {
                                       ds->request().url()));
 }
 
-void RenderFrameImpl::didNavigateWithinPage(blink::WebLocalFrame* frame,
+void RenderFrameImpl::didNavigateWithinPage(
+    blink::WebLocalFrame* frame,
     const blink::WebHistoryItem& item,
-    blink::WebHistoryCommitType commit_type) {
+    blink::WebHistoryCommitType commit_type,
+    bool content_initiated) {
   TRACE_EVENT1("navigation", "RenderFrameImpl::didNavigateWithinPage",
                "id", routing_id_);
   DCHECK_EQ(frame_, frame);
-  // If this was a reference fragment navigation that we initiated, then we
-  // could end up having a non-null pending navigation params.  We just need to
-  // update the ExtraData on the datasource so that others who read the
-  // ExtraData will get the new NavigationState.  Similarly, if we did not
-  // initiate this navigation, then we need to take care to reset any pre-
-  // existing navigation state to a content-initiated navigation state.
-  // UpdateNavigationState conveniently takes care of this for us.
   DocumentState* document_state =
       DocumentState::FromDataSource(frame->dataSource());
-  UpdateNavigationState(document_state, true /* was_within_same_page */);
+  UpdateNavigationState(document_state, true /* was_within_same_page */,
+                        content_initiated);
   static_cast<NavigationStateImpl*>(document_state->navigation_state())
       ->set_was_within_same_page(true);
 
@@ -5889,35 +5886,41 @@ NavigationState* RenderFrameImpl::CreateNavigationStateFromPending() {
 }
 
 void RenderFrameImpl::UpdateNavigationState(DocumentState* document_state,
-                                            bool was_within_same_page) {
-  if (pending_navigation_params_) {
-    // If this is a browser-initiated load that doesn't override
-    // navigation_start, set it here.
-    if (pending_navigation_params_->common_params.navigation_start.is_null()) {
-      pending_navigation_params_->common_params.navigation_start =
-          base::TimeTicks::Now();
-    }
-    document_state->set_navigation_state(CreateNavigationStateFromPending());
-
-    // The |set_was_load_data_with_base_url_request| state should not change for
-    // an in-page navigation, so skip updating it from the in-page navigation
-    // params in this case.
-    if (!was_within_same_page) {
-      const CommonNavigationParams& common_params =
-          pending_navigation_params_->common_params;
-      bool load_data = !common_params.base_url_for_data_url.is_empty() &&
-                       !common_params.history_url_for_data_url.is_empty() &&
-                       common_params.url.SchemeIs(url::kDataScheme);
-      document_state->set_was_load_data_with_base_url_request(load_data);
-      if (load_data)
-        document_state->set_data_url(common_params.url);
-    }
-
-    pending_navigation_params_.reset();
-  } else {
+                                            bool was_within_same_page,
+                                            bool content_initiated) {
+  // If this was a browser-initiated navigation, then there could be pending
+  // navigation params, so use them. Otherwise, just reset the document state
+  // here, since if pending navigation params exist they are for some other
+  // navigation <https://crbug.com/597239>.
+  if (!pending_navigation_params_ || content_initiated) {
     document_state->set_navigation_state(
         NavigationStateImpl::CreateContentInitiated());
+    return;
   }
+
+  // If this is a browser-initiated load that doesn't override
+  // navigation_start, set it here.
+  if (pending_navigation_params_->common_params.navigation_start.is_null()) {
+    pending_navigation_params_->common_params.navigation_start =
+        base::TimeTicks::Now();
+  }
+  document_state->set_navigation_state(CreateNavigationStateFromPending());
+
+  // The |set_was_load_data_with_base_url_request| state should not change for
+  // an in-page navigation, so skip updating it from the in-page navigation
+  // params in this case.
+  if (!was_within_same_page) {
+    const CommonNavigationParams& common_params =
+        pending_navigation_params_->common_params;
+    bool load_data = !common_params.base_url_for_data_url.is_empty() &&
+                     !common_params.history_url_for_data_url.is_empty() &&
+                     common_params.url.SchemeIs(url::kDataScheme);
+    document_state->set_was_load_data_with_base_url_request(load_data);
+    if (load_data)
+      document_state->set_data_url(common_params.url);
+  }
+
+  pending_navigation_params_.reset();
 }
 
 #if defined(OS_ANDROID)