Clear child FrameNavigationEntries if a history navigation redirects.

content/renderer/history_controller.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 159 matching lines @@
 }
 
 void HistoryController::UpdateForInitialLoadInChildFrame(
     RenderFrameImpl* frame,
     const WebHistoryItem& item) {
   DCHECK_NE(frame->GetWebFrame()->top(), frame->GetWebFrame());
   if (!current_entry_)
     return;
   if (HistoryEntry::HistoryNode* existing_node =
           current_entry_->GetHistoryNodeForFrame(frame)) {
+    // Clear the children and any NavigationParams if this commit isn't for
+    // the same item.  Otherwise we might have stale data after a redirect.
+    if (existing_node->item().itemSequenceNumber() !=
+        item.itemSequenceNumber()) {
+      existing_node->RemoveChildren();
+      navigation_params_.reset();
+    }

[Charlie Reis, 2016/07/15 22:42:59]

This is actually the same fix I made to UpdateForCommit earlier this week in
https://codereview.chromium.org/2144823002/.  I didn't realize at the time that
the InitialLoadInChildFrame back/forward case had the same bug, so I'm fixing it
here as well.  (The new test in this CL pointed this out.)

Note: The previous CL was fixing a case that caused NC_AUTO_SUBFRAME kills.  I
don't think this instance of the bug can cause that, because the main frame
won't ever look cross-origin.  As a result, I don't think it's necessary to pull
this change out into a separate CL for merging.

     existing_node->set_item(item);
     return;
   }
   RenderFrameImpl* parent =
       RenderFrameImpl::FromWebFrame(frame->GetWebFrame()->parent());
   if (!parent)
     return;
   if (HistoryEntry::HistoryNode* parent_history_node =
           current_entry_->GetHistoryNodeForFrame(parent)) {
     parent_history_node->AddChild(item);
@@ skipping 129 matching lines @@
     bool clone_children_of_target) {
   if (!current_entry_) {
     current_entry_.reset(new HistoryEntry(new_item));
   } else {
     current_entry_.reset(current_entry_->CloneAndReplace(
         new_item, clone_children_of_target, target_frame, render_view_));
   }
 }
 
 }  // namespace content