Don't mark navigations as in-page when DSNs are mismatched.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 5521 matching lines @@
         // PageState.
         item_for_history_navigation = entry->root();
         history_load_type = request_params.is_same_document_history_load
                                 ? blink::WebHistorySameDocumentLoad
                                 : blink::WebHistoryDifferentDocumentLoad;
         load_type = request_params.is_history_navigation_in_new_child
                         ? blink::WebFrameLoadType::InitialHistoryLoad
                         : blink::WebFrameLoadType::BackForward;
         should_load_request = true;
 
-        // If this is marked as a same document load but we haven't committed
-        // anything, treat it as a new load.  The browser shouldn't let this
-        // happen.
-        // TODO(creis): Add a similar check if the DSN doesn't match, and add a
-        // NOTREACHED when we're confident this won't happen.

[Charlie Reis, 2016/09/07 17:42:09]

I don't want to lose track of adding a NOTREACHED if the browser sends a
SameDocumentLoad type when there's no current_history_item_, but no need for a
new patch for that.  I'll just put together a CL for it after this lands.

-        if (history_load_type == blink::WebHistorySameDocumentLoad &&
-            current_history_item_.isNull()) {
-          history_load_type = blink::WebHistoryDifferentDocumentLoad;
+        if (history_load_type == blink::WebHistorySameDocumentLoad) {
+          // If this is marked as a same document load but we haven't committed
+          // anything, treat it as a new load.  The browser shouldn't let this
+          // happen.
+          if (current_history_item_.isNull()) {
+            history_load_type = blink::WebHistoryDifferentDocumentLoad;
+          } else {
+            // Additionally, if the |current_history_item_|'s document
+            // sequence number doesn't match the one sent from the browser, it
+            // is possible that this renderer has committed a different
+            // document. In such case, don't use WebHistorySameDocumentLoad.
+            if (current_history_item_.documentSequenceNumber() !=
+                item_for_history_navigation.documentSequenceNumber()) {
+              history_load_type = blink::WebHistoryDifferentDocumentLoad;
+            }
+          }
         }
 
         // If this navigation is to a history item for a new child frame, we may
         // want to ignore it in some cases.  If a Javascript navigation (i.e.,
         // client redirect) interrupted it and has either been scheduled,
         // started loading, or has committed, we should ignore the history item.
         // Similarly, if the history item just says to stay on about:blank,
         // don't load it again, which might clobber injected content.
         bool interrupted_by_client_redirect =
             frame_->isNavigationScheduledWithin(0) ||
@@ skipping 791 matching lines @@
   // event target. Potentially a Pepper plugin will receive the event.
   // In order to tell whether a plugin gets the last mouse event and which it
   // is, we set |pepper_last_mouse_event_target_| to null here. If a plugin gets
   // the event, it will notify us via DidReceiveMouseEvent() and set itself as
   // |pepper_last_mouse_event_target_|.
   pepper_last_mouse_event_target_ = nullptr;
 #endif
 }
 
 }  // namespace content