Clear stale NavigationParams from HistoryController.

content/renderer/history_controller.h

Index: content/renderer/history_controller.h
diff --git a/content/renderer/history_controller.h b/content/renderer/history_controller.h
index ff20596701492e50adce619e98005bbf8c8c0b84..ac522418889ed302cd63f711c09b87c70911b51b 100644
--- a/content/renderer/history_controller.h
+++ b/content/renderer/history_controller.h
@@ -153,11 +153,15 @@ class CONTENT_EXPORT HistoryController {
   // A HistoryEntry representing the page that is being loaded, or an empty
   // scoped_ptr if no page is being loaded.
   std::unique_ptr<HistoryEntry> provisional_entry_;
-  // The NavigationParams corresponding to the last load that was initiated by
-  // |GoToEntry|. This is kept around so that it can be passed into existing
-  // frames modified during a history navigation in GoToEntry(), and can be
+
+  // The NavigationParams corresponding to the last back/forward load that was
+  // initiated by |GoToEntry|. This is kept around so that it can be passed into
+  // existing frames affected by a history navigation in GoToEntry(), and can be
   // passed into frames created after the commit that resulted from the
   // navigation in GetItemForNewChildFrame().
+  //
+  // This is reset in UpdateForCommit if we see a commit from a different
+  // navigation, to avoid using stale parameters.
   std::unique_ptr<NavigationParams> navigation_params_;
 
   DISALLOW_COPY_AND_ASSIGN(HistoryController);