Prevent renderer kills for in-page navigations on subframes.

content/renderer/history_controller.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 117 matching lines @@
 
 void HistoryController::RecursiveGoToEntry(
     WebFrame* frame,
     HistoryFrameLoadVector& same_document_loads,
     HistoryFrameLoadVector& different_document_loads) {
   DCHECK(provisional_entry_);
   DCHECK(current_entry_);
   RenderFrameImpl* render_frame = RenderFrameImpl::FromWebFrame(frame);
   const WebHistoryItem& new_item =
       provisional_entry_->GetItemForFrame(render_frame);
-  const WebHistoryItem& old_item =
-      current_entry_->GetItemForFrame(render_frame);
+
+  // Use the last committed history item for the frame rather than
+  // current_entry_, since the latter may not accurately reflect which URL is
+  // currently committed in the frame.  See https://crbug.com/612713#c12.
+  const WebHistoryItem& old_item = render_frame->current_history_item();
+
   if (new_item.isNull())
     return;
 
   if (old_item.isNull() ||
       new_item.itemSequenceNumber() != old_item.itemSequenceNumber()) {
     if (!old_item.isNull() &&
         new_item.documentSequenceNumber() ==
             old_item.documentSequenceNumber()) {
       same_document_loads.push_back(std::make_pair(frame, new_item));
 
@@ skipping 134 matching lines @@
     bool clone_children_of_target) {
   if (!current_entry_) {
     current_entry_.reset(new HistoryEntry(new_item));
   } else {
     current_entry_.reset(current_entry_->CloneAndReplace(
         new_item, clone_children_of_target, target_frame, render_view_));
   }
 }
 
 }  // namespace content