Prevent renderer kills for in-page navigations on subframes.

content/renderer/history_entry.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 46 matching lines @@
 HistoryEntry::HistoryNode* HistoryEntry::HistoryNode::CloneAndReplace(
     const base::WeakPtr<HistoryEntry>& new_entry,
     const WebHistoryItem& new_item,
     bool clone_children_of_target,
     RenderFrameImpl* target_frame,
     RenderFrameImpl* current_frame) {
   bool is_target_frame = target_frame == current_frame;
   const WebHistoryItem& item_for_create = is_target_frame ? new_item : item_;
   HistoryNode* new_history_node = new HistoryNode(new_entry, item_for_create);
 
-  if (is_target_frame && clone_children_of_target && !item_.isNull()) {
+  if (is_target_frame && clone_children_of_target &&
+      !current_frame->current_history_item().isNull()) {
     new_history_node->item().setDocumentSequenceNumber(
-        item_.documentSequenceNumber());
+        current_frame->current_history_item().documentSequenceNumber());

[Charlie Reis, 2016/06/03 19:20:36]

This fixes BackToAboutBlankIframe and BackToIframeWithContent in default Chrome,
since we can't trust the item_ of the last committed HistoryEntry to be
accurate.  (I'm actually quite surprised we need this block at all, and we don't
have it in FNE-enabled modes.  I'll have to dig into source history to see why
it was added, but for now this is a fix that makes it work.)

[Avi (use Gerrit), 2016/06/03 20:26:57]

Pull out |current_frame->current_history_item()| with a comment?

[Charlie Reis, 2016/06/03 20:53:28]

Done.

   }
 
   // TODO(creis): This needs to be updated to handle HistoryEntry in
   // subframe processes, where the main frame isn't guaranteed to be in the
   // same process.
   if (current_frame && (clone_children_of_target || !is_target_frame)) {
     for (WebFrame* child = current_frame->GetWebFrame()->firstChild(); child;
          child = child->nextSibling()) {
       RenderFrameImpl* child_render_frame =
           RenderFrameImpl::FromWebFrame(child);
@@ skipping 79 matching lines @@
   return unique_names_to_items_[frame->GetWebFrame()->uniqueName().utf8()];
 }
 
 WebHistoryItem HistoryEntry::GetItemForFrame(RenderFrameImpl* frame) {
   if (HistoryNode* history_node = GetHistoryNodeForFrame(frame))
     return history_node->item();
   return WebHistoryItem();
 }
 
 }  // namespace content