Add check for mismatching item and document sequence numbers.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 1fb9201c58d29fbde43c47ce8305b46c99893df0..645673328ea06ae300a480e34d207fb8099a3ccc 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -10,6 +10,7 @@
 #include <utility>
 
 #include "base/command_line.h"
+#include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
@@ -81,6 +82,7 @@
 #include "content/common/input/web_input_event_traits.h"
 #include "content/common/input_messages.h"
 #include "content/common/page_messages.h"
+#include "content/common/page_state_serialization.h"
 #include "content/common/site_isolation_policy.h"
 #include "content/common/ssl_status_serialization.h"
 #include "content/common/view_messages.h"
@@ -4475,6 +4477,24 @@ void WebContentsImpl::UpdateStateForFrame(RenderFrameHost* render_frame_host,
   if (page_state == frame_entry->page_state())
     return;  // Nothing to update.
 
+  // The document_sequence_number and item_sequence_number recorded in the
+  // FrameNavigationEntry should not differ from the one coming with the update,
+  // since it must come from the same document.
+  ExplodedPageState exploded_state;
+  if (!DecodePageState(page_state.ToEncodedData(), &exploded_state))
+    return;

[Charlie Reis, 2016/07/22 22:46:11]

I'm slightly curious if there are ever cases we'd return here, unable to decode
it.  Hopefully not?  (I suppose we can ignore for now.)

[nasko, 2016/07/22 23:02:34]

It would fail only in the case we fail to deserialize the data. If that is the
case, though, I doubt we want to store that object.

+
+  if (exploded_state.top.document_sequence_number !=
+          frame_entry->document_sequence_number() ||
+      exploded_state.top.item_sequence_number !=
+          frame_entry->item_sequence_number()) {
+    // TODO(nasko): Generate a minidump, which can be debugged to understand the

[Charlie Reis, 2016/07/22 22:46:11]

This isn't really a TODO, since we're generating the minidump below.  :)

Maybe separately put a TODO to remove it once we diagnose
https://crbug.com/628677?

[nasko, 2016/07/22 23:02:34]

Hah, this is what I meant to do, but didn't. Fixed!

+    // root cause of this unexpected update.
+    base::debug::Alias(&page_state);
+    base::debug::DumpWithoutCrashing();
+    return;
+  }
+
   frame_entry->set_page_state(page_state);
   controller_.NotifyEntryChanged(entry);
 }