Don't mark navigations as in-page when DSNs are mismatched.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index cb9e3d3faa5df2dc38de129057f07c3d243797bb..6276bf6ca0646af488829afddc4d00dba6122a61 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -5530,12 +5530,16 @@ void RenderFrameImpl::NavigateInternal(
 
         // If this is marked as a same document load but we haven't committed
         // anything, treat it as a new load.  The browser shouldn't let this
-        // happen.
-        // TODO(creis): Add a similar check if the DSN doesn't match, and add a
-        // NOTREACHED when we're confident this won't happen.
-        if (history_load_type == blink::WebHistorySameDocumentLoad &&
-            current_history_item_.isNull()) {
-          history_load_type = blink::WebHistoryDifferentDocumentLoad;
+        // happen. Also treat it as a new load, if the DSN in
+        // |current_history_item_| and the item navigated to mismatch.
+        if (history_load_type == blink::WebHistorySameDocumentLoad) {
+           if (current_history_item_.isNull()) {
+             history_load_type = blink::WebHistoryDifferentDocumentLoad;
+           } else if (current_history_item_.documentSequenceNumber() !=
+                      item_for_history_navigation.documentSequenceNumber()) {
+             history_load_type = blink::WebHistoryDifferentDocumentLoad;
+             NOTREACHED();

[Charlie Reis, 2016/08/22 12:20:21]

I don't think we can have a NOTREACHED in this case, due to races where the
renderer process navigates to a different document (e.g., synchronous commit to
about:blank) just as the browser is telling it to go back in-page.  I bet we
could even write a test for that case.  :)

My TODO to add a NOTREACHED was for the "no current history item" case, when the
browser should know better than to treat it as in-page.  We should still do
that.

+           }
         }
 
         // If this navigation is to a history item for a new child frame, we may