Update HistoryController::current_entry_ on all main frame back/forwards.

content/renderer/history_controller.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 178 matching lines @@
     parent_history_node->AddChild(item);
   }
 }
 
 void HistoryController::UpdateForCommit(RenderFrameImpl* frame,
                                         const WebHistoryItem& item,
                                         WebHistoryCommitType commit_type,
                                         bool navigation_within_page) {
   switch (commit_type) {
     case blink::WebBackForwardCommit:
-      if (!provisional_entry_)
+      if (!provisional_entry_) {
+        // The provisional entry may have been discarded due to a navigation in
+        // a different frame.  For main frames, it is not safe to leave the
+        // current_entry_ in place, which may have a cross-site page and will be
+        // included in the PageState for this commit.  Replace it with a new
+        // HistoryEntry corresponding to the commit.
+        //
+        // This will lack any subframe history items that were in the original
+        // provisional entry, but we don't know what those were after discarding
+        // it.  We'll load the default URL in those subframes instead.
+        //
+        // TODO(creis): It's also possible to get here for subframe commits.
+        // We'll leave a stale current_entry_ in that case, but that only causes
+        // an earlier URL to load in the subframe when leaving and coming back,
+        // and only in rare cases.  It does not risk a URL spoof, unlike the
+        // main frame case.  Since this bug is not present in the new
+        // FrameNavigationEntry-based navigation path (https://crbug.com/236848)
+        // we'll wait for that to fix the subframe case.
+        if (frame->IsMainFrame())
+          current_entry_.reset(new HistoryEntry(item));
+
         return;
+      }
 
       // If the current entry is null, this must be a main frame commit.
       DCHECK(current_entry_ || frame->IsMainFrame());
 
       // Commit the provisional entry, but only if it is a plausible transition.
       // Do not commit it if the navigation is in a subframe and the provisional
       // entry's main frame item does not match the current entry's main frame,
       // which can happen if multiple forward navigations occur.  In that case,
       // committing the provisional entry would corrupt it, leading to a URL
       // spoof.  See https://crbug.com/597322.  (Note that the race in this bug
@@ skipping 77 matching lines @@
     bool clone_children_of_target) {
   if (!current_entry_) {
     current_entry_.reset(new HistoryEntry(new_item));
   } else {
     current_entry_.reset(current_entry_->CloneAndReplace(
         new_item, clone_children_of_target, target_frame, render_view_));
   }
 }
 
 }  // namespace content