Clear child FrameNavigationEntries if a history navigation redirects.

content/browser/frame_host/navigation_entry_impl.cc

Index: content/browser/frame_host/navigation_entry_impl.cc
diff --git a/content/browser/frame_host/navigation_entry_impl.cc b/content/browser/frame_host/navigation_entry_impl.cc
index 0d4f9f0d72f4941f5945a61f8451f3b912ec4f48..6baa2a7fbd5ddd817b9ecfd74524e70a65e96eac 100644
--- a/content/browser/frame_host/navigation_entry_impl.cc
+++ b/content/browser/frame_host/navigation_entry_impl.cc
@@ -714,6 +714,12 @@ void NavigationEntryImpl::AddOrUpdateFrameEntry(
   const std::string& unique_name = frame_tree_node->unique_name();
   for (TreeNode* child : parent_node->children) {
     if (child->frame_entry->frame_unique_name() == unique_name) {
+      // If the document of the FrameNavigationEntry is changing, we must clear
+      // any child FrameNavigationEntries.
+      if (child->frame_entry->document_sequence_number() !=
+          document_sequence_number)
+        child->children.clear();
+
       // Update the existing FrameNavigationEntry (e.g., for replaceState).
       child->frame_entry->UpdateEntry(unique_name, item_sequence_number,
                                       document_sequence_number, site_instance,
@@ -741,6 +747,12 @@ FrameNavigationEntry* NavigationEntryImpl::GetFrameEntry(
   return tree_node ? tree_node->frame_entry.get() : nullptr;
 }
 
+void NavigationEntryImpl::ClearChildren(FrameTreeNode* frame_tree_node) {
+  NavigationEntryImpl::TreeNode* tree_node = FindFrameEntry(frame_tree_node);
+  if (tree_node)
+    tree_node->children.clear();
+}
+
 void NavigationEntryImpl::SetScreenshotPNGData(
     scoped_refptr<base::RefCountedBytes> png_data) {
   screenshot_ = png_data;