Don't mark navigations as in-page when DSNs are mismatched.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 4c5d7a3e37e4de3e3fa88be809293cc7e867c2ec..1fd0a0139f5eafdb4d2fe205ee1995727a545ef9 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -5539,14 +5539,22 @@ void RenderFrameImpl::NavigateInternal(
                         : blink::WebFrameLoadType::BackForward;
         should_load_request = true;
 
-        // If this is marked as a same document load but we haven't committed
-        // anything, treat it as a new load.  The browser shouldn't let this
-        // happen.
-        // TODO(creis): Add a similar check if the DSN doesn't match, and add a
-        // NOTREACHED when we're confident this won't happen.

[Charlie Reis, 2016/09/07 17:42:09]

I don't want to lose track of adding a NOTREACHED if the browser sends a
SameDocumentLoad type when there's no current_history_item_, but no need for a
new patch for that.  I'll just put together a CL for it after this lands.

-        if (history_load_type == blink::WebHistorySameDocumentLoad &&
-            current_history_item_.isNull()) {
-          history_load_type = blink::WebHistoryDifferentDocumentLoad;
+        if (history_load_type == blink::WebHistorySameDocumentLoad) {
+          // If this is marked as a same document load but we haven't committed
+          // anything, treat it as a new load.  The browser shouldn't let this
+          // happen.
+          if (current_history_item_.isNull()) {
+            history_load_type = blink::WebHistoryDifferentDocumentLoad;
+          } else {
+            // Additionally, if the |current_history_item_|'s document
+            // sequence number doesn't match the one sent from the browser, it
+            // is possible that this renderer has committed a different
+            // document. In such case, don't use WebHistorySameDocumentLoad.
+            if (current_history_item_.documentSequenceNumber() !=
+                item_for_history_navigation.documentSequenceNumber()) {
+              history_load_type = blink::WebHistoryDifferentDocumentLoad;
+            }
+          }
         }
 
         // If this navigation is to a history item for a new child frame, we may