Prevent renderer kills for in-page navigations on subframes.

content/renderer/history_entry.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 46 matching lines @@
 HistoryEntry::HistoryNode* HistoryEntry::HistoryNode::CloneAndReplace(
     const base::WeakPtr<HistoryEntry>& new_entry,
     const WebHistoryItem& new_item,
     bool clone_children_of_target,
     RenderFrameImpl* target_frame,
     RenderFrameImpl* current_frame) {
   bool is_target_frame = target_frame == current_frame;
   const WebHistoryItem& item_for_create = is_target_frame ? new_item : item_;
   HistoryNode* new_history_node = new HistoryNode(new_entry, item_for_create);
 
-  if (is_target_frame && clone_children_of_target && !item_.isNull()) {
+  // Use the last committed history item for the frame rather than item_, since
+  // the latter may not accurately reflect which URL is currently committed in
+  // the frame.  See https://crbug.com/612713#c12.
+  const WebHistoryItem& current_item = current_frame->current_history_item();
+  if (is_target_frame && clone_children_of_target && !current_item.isNull()) {
     new_history_node->item().setDocumentSequenceNumber(
-        item_.documentSequenceNumber());
+        current_item.documentSequenceNumber());
   }
 
   // TODO(creis): This needs to be updated to handle HistoryEntry in
   // subframe processes, where the main frame isn't guaranteed to be in the
   // same process.
   if (current_frame && (clone_children_of_target || !is_target_frame)) {
     for (WebFrame* child = current_frame->GetWebFrame()->firstChild(); child;
          child = child->nextSibling()) {
       RenderFrameImpl* child_render_frame =
           RenderFrameImpl::FromWebFrame(child);
@@ skipping 79 matching lines @@
   return unique_names_to_items_[frame->GetWebFrame()->uniqueName().utf8()];
 }
 
 WebHistoryItem HistoryEntry::GetItemForFrame(RenderFrameImpl* frame) {
   if (HistoryNode* history_node = GetHistoryNodeForFrame(frame))
     return history_node->item();
   return WebHistoryItem();
 }
 
 }  // namespace content