Don't mark a history navigation as in page in a new renderer process.

content/browser/frame_host/navigation_controller_impl_browsertest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 3720 matching lines @@
   }
 
   // Go back.
   {
     TestNavigationObserver back_load_observer(new_tab.get());
     new_controller.GoBack();
     back_load_observer.Wait();
   }
 }
 
+// Ensure that going back/forward to an apparently in-page NavigationEntry works
+// when the renderer process hasn't committed anything yet.  This can happen
+// when using Ctrl+Back or after a crash.  See https://crbug.com/635403.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       BackInPageInNewWindow) {
+  // Start on an initial page.
+  GURL url_1(embedded_test_server()->GetURL(
+      "/navigation_controller/simple_page_1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url_1));
+
+  // Navigate it in-page.
+  GURL url_2(embedded_test_server()->GetURL(
+      "/navigation_controller/simple_page_1.html#foo"));
+  EXPECT_TRUE(NavigateToURL(shell(), url_2));
+
+  // Clone the tab but don't load last committed page.
+  std::unique_ptr<WebContentsImpl> new_tab(
+      static_cast<WebContentsImpl*>(shell()->web_contents()->Clone()));
+  NavigationController& new_controller = new_tab->GetController();
+  EXPECT_TRUE(new_controller.IsInitialNavigation());
+  EXPECT_TRUE(new_controller.NeedsReload());
+
+  // Go back in the new tab.
+  {
+    TestNavigationObserver back_load_observer(new_tab.get());
+    new_controller.GoBack();
+    back_load_observer.Wait();
+  }
+
+  // Make sure the new tab isn't still loading.
+  EXPECT_EQ(url_1, new_controller.GetLastCommittedEntry()->GetURL());
+  EXPECT_FALSE(new_tab->IsLoading());
+
+  // Also check going back in the original tab after a renderer crash.
+  NavigationController& controller = shell()->web_contents()->GetController();
+  RenderProcessHost* process = shell()->web_contents()->GetRenderProcessHost();
+  RenderProcessHostWatcher crash_observer(
+      process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  process->Shutdown(0, false);
+  crash_observer.Wait();
+  {
+    TestNavigationObserver back_load_observer(shell()->web_contents());
+    controller.GoBack();
+    back_load_observer.Wait();
+  }
+
+  // Make sure the original tab isn't still loading.
+  EXPECT_EQ(url_1, controller.GetLastCommittedEntry()->GetURL());
+  EXPECT_FALSE(shell()->web_contents()->IsLoading());
+}
+
 // Ensures that FrameNavigationEntries for dynamically added iframes can be
 // found correctly when cloning them during a transfer.  If we don't look for
 // them based on unique name in AddOrUpdateFrameEntry, the FrameTreeNode ID
 // mismatch will cause us to create a second FrameNavigationEntry during the
 // transfer.  Later, we'll find the wrong FrameNavigationEntry (the earlier one
 // from the clone which still has a PageState), and this will cause the renderer
 // to crash in NavigateInternal because the PageState is present but the page_id
 // is -1 (similar to https://crbug.com/568703).  See https://crbug.com/568768.
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
                        FrameNavigationEntry_RepeatCreatedFrame) {
@@ skipping 1951 matching lines @@
   if (SiteIsolationPolicy::UseSubframeNavigationEntries()) {
     EXPECT_EQ(1U, nav_entry->root_node()->children.size());
     EXPECT_EQ(tree_node, nav_entry->root_node()->children[0]);
   }
 
   EXPECT_TRUE(ExecuteScript(root, kRemoveFrameScript));
   EXPECT_EQ(0U, root->child_count());
 }
 
 }  // namespace content