Don't mark a history navigation as in page in a new renderer process.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 1892 matching lines @@
   if (!new_item)
     return;
 
   // Schedule a load in this frame if the new item isn't for the same item
   // sequence number in the same SiteInstance. Newly restored items may not have
   // a SiteInstance yet, in which case it will be assigned on first commit.
   if (!old_item ||
       new_item->item_sequence_number() != old_item->item_sequence_number() ||
       (new_item->site_instance() != nullptr &&
        new_item->site_instance() != old_item->site_instance())) {
+    // Same document loads happen if the previous item has the same document
+    // sequence number.  Note that we should treat them as different document if
+    // the destination RenderFrameHost (which is necessarily the current
+    // RenderFrameHost for same document navigations) doesn't have a last
+    // committed page.  This case can happen for Ctrl+Back or after a renderer
+    // crash.
     if (old_item &&
         new_item->document_sequence_number() ==
-            old_item->document_sequence_number()) {
+            old_item->document_sequence_number() &&
+        !frame->current_frame_host()->last_committed_url().is_empty()) {
       same_document_loads->push_back(std::make_pair(frame, new_item));
 
       // TODO(avi, creis): This is a bug; we should not return here. Rather, we
       // should continue on and navigate all child frames which have also
       // changed. This bug is the cause of <https://crbug.com/542299>, which is
       // a NC_IN_PAGE_NAVIGATION renderer kill.
       //
       // However, this bug is a bandaid over a deeper and worse problem. Doing a
       // pushState immediately after loading a subframe is a race, one that no
       // web page author expects. If we fix this bug, many large websites break.
@@ skipping 178 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content