Clear child FrameNavigationEntries if a history navigation redirects.

content/browser/frame_host/navigation_entry_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_entry_impl.h"
 
 #include <stddef.h>
 
 #include <queue>
 #include <utility>
@@ skipping 696 matching lines @@
   if (!parent_node) {
     // The renderer should not send a commit for a subframe before its parent.
     // TODO(creis): Kill the renderer if we get here.
     return;
   }
 
   // Now check whether we have a TreeNode for the node itself.
   const std::string& unique_name = frame_tree_node->unique_name();
   for (TreeNode* child : parent_node->children) {
     if (child->frame_entry->frame_unique_name() == unique_name) {
+      // If the document of the FrameNavigationEntry is changing, we must clear
+      // any child FrameNavigationEntries.
+      if (child->frame_entry->document_sequence_number() !=
+          document_sequence_number)
+        child->children.clear();
+
       // Update the existing FrameNavigationEntry (e.g., for replaceState).
       child->frame_entry->UpdateEntry(unique_name, item_sequence_number,
                                       document_sequence_number, site_instance,
                                       std::move(source_site_instance), url,
                                       referrer, page_state, method, post_id);
       return;
     }
   }
 
   // No entry exists yet, so create a new one.
   // Unordered list, since we expect to look up entries by frame sequence number
   // or unique name.
   FrameNavigationEntry* frame_entry = new FrameNavigationEntry(
       unique_name, item_sequence_number, document_sequence_number,
       site_instance, std::move(source_site_instance), url, referrer, method,
       post_id);
   frame_entry->set_page_state(page_state);
   parent_node->children.push_back(
       new NavigationEntryImpl::TreeNode(frame_entry));
 }
 
 FrameNavigationEntry* NavigationEntryImpl::GetFrameEntry(
     FrameTreeNode* frame_tree_node) const {
   NavigationEntryImpl::TreeNode* tree_node = FindFrameEntry(frame_tree_node);
   return tree_node ? tree_node->frame_entry.get() : nullptr;
 }
 
+void NavigationEntryImpl::ClearChildren(FrameTreeNode* frame_tree_node) {
+  NavigationEntryImpl::TreeNode* tree_node = FindFrameEntry(frame_tree_node);
+  if (tree_node)
+    tree_node->children.clear();
+}
+
 void NavigationEntryImpl::SetScreenshotPNGData(
     scoped_refptr<base::RefCountedBytes> png_data) {
   screenshot_ = png_data;
   if (screenshot_.get())
     UMA_HISTOGRAM_MEMORY_KB("Overscroll.ScreenshotSize", screenshot_->size());
 }
 
 GURL NavigationEntryImpl::GetHistoryURLForDataURL() const {
   return GetBaseURLForDataURL().is_empty() ? GURL() : GetVirtualURL();
 }
@@ skipping 10 matching lines @@
       return node;
 
     // Enqueue any children and keep looking.
     for (auto& child : node->children)
       work_queue.push(child);
   }
   return nullptr;
 }
 
 }  // namespace content