Ensure FrameNavigationEntry is fully updated.

content/browser/frame_host/navigation_controller_impl_browsertest.cc

Index: content/browser/frame_host/navigation_controller_impl_browsertest.cc
diff --git a/content/browser/frame_host/navigation_controller_impl_browsertest.cc b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
index 4594946033b61ab03c8ae56ce52954927d83dd72..78d472b4a82f392ebc790ba41d16fa15c1fca2d4 100644
--- a/content/browser/frame_host/navigation_controller_impl_browsertest.cc
+++ b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
@@ -5616,4 +5616,64 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_EQ(0U, root->child_count());
 }
 
+// Test that navigations classified as SAME_PAGE properly update all the
+// members of FrameNavigationEntry. If not, it is possible to get a mismatch
+// between the origin and URL of a document as seen in
+// https://crbug.com/630103.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       EnsureSamePageNavigationUpdatesFrameNavigationEntry) {
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  FrameTreeNode* root = web_contents->GetFrameTree()->root();
+
+  // Navigate to a simple page and then perform an in-page navigation.
+  GURL start_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), start_url));
+
+  GURL same_page_url(
+      embedded_test_server()->GetURL("a.com", "/title1.html#foo"));
+  EXPECT_TRUE(NavigateToURL(shell(), same_page_url));
+  EXPECT_EQ(2, web_contents->GetController().GetEntryCount());
+
+  // Replace the URL of the current NavigationEntry with one that will cause
+  // a server redirect when loaded.
+  {
+    GURL redirect_dest_url(
+        embedded_test_server()->GetURL("sub.a.com", "/simple_page.html"));

[nasko, 2016/08/10 21:26:56]

Went back to using cross-origin instead of cross-site, as cross-site SAME_PAGE
navigation classification doesn't work. The test ends up getting a new session
history entry since the navigation is classified as NEW_PAGE and the entire test
is thrown off.

[Charlie Reis, 2016/08/10 21:28:58]

Yes, I could believe --site-per-process gets that wrong.  Sticking with
cross-origin sounds fine for now, and we can revisit when we get rid of
SAME_PAGE.  Thanks for the fix!

+    TestNavigationObserver observer(web_contents);
+    std::string script = "history.replaceState({}, '', '/server-redirect?" +
+                         redirect_dest_url.spec() + "')";
+    EXPECT_TRUE(ExecuteScript(root, script));
+    observer.Wait();
+  }
+
+  // Simulate the user hitting Enter in the omnibox without changing the URL.
+  {
+    TestNavigationObserver observer(web_contents);
+    web_contents->GetController().LoadURL(web_contents->GetLastCommittedURL(),
+                                          Referrer(), ui::PAGE_TRANSITION_LINK,
+                                          std::string());
+    observer.Wait();
+  }
+
+  // Prior to fixing the issue, the above omnibox navigation (which is
+  // classified as SAME_PAGE) was leaving the FrameNavigationEntry with the
+  // same document sequence number as the previous entry but updates the URL.
+  // Doing a back session history navigation now will cause the browser to
+  // consider it as in-page because of this matching document sequence number
+  // and lead to a mismatch of origin and URL in the renderer process.
+  {
+    TestNavigationObserver observer(web_contents);
+    web_contents->GetController().GoBack();
+    observer.Wait();
+  }
+
+  // Verify the expected origin through JavaScript. It also has the additional
+  // verification of the process also being still alive.
+  std::string origin;
+  EXPECT_TRUE(ExecuteScriptAndExtractString(
+      web_contents, "domAutomationController.send(document.origin)", &origin));
+  EXPECT_EQ(start_url.GetOrigin().spec(), origin + "/");
+}
+
 }  // namespace content