Add regression test for an aborting navigation losing its nav_entry_id

content/browser/frame_host/navigation_controller_impl_browsertest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 4993 matching lines @@
   NavigationEntry* entry = controller.GetEntryAtIndex(1);
   EXPECT_EQ(url_a, entry->GetURL());
   ExplodedPageState exploded_state;
   EXPECT_TRUE(
       DecodePageState(entry->GetPageState().ToEncodedData(), &exploded_state));
   EXPECT_EQ(url_a, GURL(exploded_state.top.url_string.string()));
   EXPECT_EQ(frame_url_a2,
             GURL(exploded_state.top.children.at(0).url_string.string()));
 }
 
+// Start a provisional navigation, but abort it by going back before it commits.
+// In crbug.com/631617 there was an issue which cleared the
+// pending_navigation_params_ in RenderFrameImpl. This caused the interrupting
+// navigation to lose important navigation data like its nav_entry_id, which
+// could cause it to commit in-place instead of in the correct location in the
+// browsing history.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       AbortProvisionalLoadRetainsNavigationParams) {
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title2.html")));
+
+  TestNavigationManager delayer(shell()->web_contents(),
+                                embedded_test_server()->GetURL("/title3.html"));
+  shell()->LoadURL(embedded_test_server()->GetURL("/title3.html"));
+  delayer.WaitForWillStartRequest();
+
+  NavigationController& controller = shell()->web_contents()->GetController();
+
+  TestNavigationManager back_manager(
+      shell()->web_contents(), embedded_test_server()->GetURL("/title1.html"));
+  controller.GoBack();
+  back_manager.WaitForNavigationFinished();
+
+  EXPECT_TRUE(controller.CanGoForward());
+  EXPECT_EQ(0, controller.GetCurrentEntryIndex());
+}
+
 // Ensure that we do not corrupt a NavigationEntry's PageState if two forward
 // navigations compete in different frames.  See https://crbug.com/623319.
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
                        PageStateAfterForwardInCompetingFrames) {
   // Navigate to a page with an iframe.
   GURL url_a(embedded_test_server()->GetURL(
       "/navigation_controller/page_with_data_iframe.html"));
   GURL frame_url_a1("data:text/html,Subframe");
   EXPECT_TRUE(NavigateToURL(shell(), url_a));
 
@@ skipping 367 matching lines @@
   std::string body;
   EXPECT_TRUE(ExecuteScriptAndExtractString(
       shell()->web_contents(),
       "window.domAutomationController.send("
       "document.getElementsByTagName('pre')[0].innerText);",
       &body));
   EXPECT_EQ("text=value\n", body);
 }
 
 }  // namespace content