Don't mark a history navigation as in page in a new renderer process.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 5474 matching lines @@
         // PageState.
         item_for_history_navigation = entry->root();
         history_load_type = request_params.is_same_document_history_load
                                 ? blink::WebHistorySameDocumentLoad
                                 : blink::WebHistoryDifferentDocumentLoad;
         load_type = request_params.is_history_navigation_in_new_child
                         ? blink::WebFrameLoadType::InitialHistoryLoad
                         : blink::WebFrameLoadType::BackForward;
         should_load_request = true;
 
+        // If this is marked as a same document load but we haven't committed
+        // anything, treat it as a new load.  The browser shouldn't let this
+        // happen.
+        // TODO(creis): Add a similar check if the DSN doesn't match, and add a
+        // NOTREACHED when we're confident this won't happen.
+        if (history_load_type == blink::WebHistorySameDocumentLoad &&
+            current_history_item_.isNull()) {
+          history_load_type = blink::WebHistoryDifferentDocumentLoad;
+        }
+
         // If this navigation is to a history item for a new child frame, we may
         // want to ignore it in some cases.  If a Javascript navigation (i.e.,
         // client redirect) interrupted it and has either been scheduled,
         // started loading, or has committed, we should ignore the history item.
         // Similarly, if the history item just says to stay on about:blank,
         // don't load it again, which might clobber injected content.
         bool interrupted_by_client_redirect =
             frame_->isNavigationScheduledWithin(0) ||
             frame_->provisionalDataSource() ||
             !current_history_item_.isNull();
@@ skipping 792 matching lines @@
   // event target. Potentially a Pepper plugin will receive the event.
   // In order to tell whether a plugin gets the last mouse event and which it
   // is, we set |pepper_last_mouse_event_target_| to null here. If a plugin gets
   // the event, it will notify us via DidReceiveMouseEvent() and set itself as
   // |pepper_last_mouse_event_target_|.
   pepper_last_mouse_event_target_ = nullptr;
 #endif
 }
 
 }  // namespace content