Add check for mismatching item and document sequence numbers.

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <stddef.h>
 
 #include <cmath>
 #include <utility>
 
 #include "base/command_line.h"
+#include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/metrics/histogram.h"
 #include "base/process/process.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/single_thread_task_runner.h"
@@ skipping 51 matching lines @@
 #include "content/browser/web_contents/web_contents_view_guest.h"
 #include "content/browser/webui/generic_handler.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/browser/webui/web_ui_impl.h"
 #include "content/common/browser_plugin/browser_plugin_constants.h"
 #include "content/common/browser_plugin/browser_plugin_messages.h"
 #include "content/common/frame_messages.h"
 #include "content/common/input/web_input_event_traits.h"
 #include "content/common/input_messages.h"
 #include "content/common/page_messages.h"
+#include "content/common/page_state_serialization.h"
 #include "content/common/site_isolation_policy.h"
 #include "content/common/ssl_status_serialization.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/ax_event_notification_details.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_plugin_guest_manager.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/devtools_agent_host.h"
 #include "content/public/browser/download_manager.h"
 #include "content/public/browser/download_url_parameters.h"
@@ skipping 4374 matching lines @@
   // The SiteInstance might not match if we do a cross-process navigation with
   // replacement (e.g., auto-subframe), in which case the swap out of the old
   // RenderFrameHost runs in the background after the old FrameNavigationEntry
   // has already been replaced and destroyed.
   if (frame_entry->site_instance() != rfhi->GetSiteInstance())
     return;
 
   if (page_state == frame_entry->page_state())
     return;  // Nothing to update.
 
+  // The document_sequence_number and item_sequence_number recorded in the
+  // FrameNavigationEntry should not differ from the one coming with the update,
+  // since it must come from the same document.
+  ExplodedPageState exploded_state;
+  if (!DecodePageState(page_state.ToEncodedData(), &exploded_state))
+    return;

[Charlie Reis, 2016/07/22 22:46:11]

I'm slightly curious if there are ever cases we'd return here, unable to decode
it.  Hopefully not?  (I suppose we can ignore for now.)

[nasko, 2016/07/22 23:02:34]

It would fail only in the case we fail to deserialize the data. If that is the
case, though, I doubt we want to store that object.

+
+  if (exploded_state.top.document_sequence_number !=
+          frame_entry->document_sequence_number() ||
+      exploded_state.top.item_sequence_number !=
+          frame_entry->item_sequence_number()) {
+    // TODO(nasko): Generate a minidump, which can be debugged to understand the

[Charlie Reis, 2016/07/22 22:46:11]

This isn't really a TODO, since we're generating the minidump below.  :)

Maybe separately put a TODO to remove it once we diagnose
https://crbug.com/628677?

[nasko, 2016/07/22 23:02:34]

Hah, this is what I meant to do, but didn't. Fixed!

+    // root cause of this unexpected update.
+    base::debug::Alias(&page_state);
+    base::debug::DumpWithoutCrashing();
+    return;
+  }
+
   frame_entry->set_page_state(page_state);
   controller_.NotifyEntryChanged(entry);
 }
 
 void WebContentsImpl::UpdateTitle(RenderFrameHost* render_frame_host,
                                   int32_t page_id,
                                   const base::string16& title,
                                   base::i18n::TextDirection title_direction) {
   // If we have a title, that's a pretty good indication that we've started
   // getting useful data.
@@ skipping 665 matching lines @@
   for (RenderViewHost* render_view_host : render_view_host_set)
     render_view_host->OnWebkitPreferencesChanged();
 }
 
 void WebContentsImpl::SetJavaScriptDialogManagerForTesting(
     JavaScriptDialogManager* dialog_manager) {
   dialog_manager_ = dialog_manager;
 }
 
 }  // namespace content