Avoid mutating frame unique name after first real commit.

third_party/WebKit/Source/core/page/FrameTree.cpp

 /*
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 44 matching lines @@
 void FrameTree::setName(const AtomicString& name)
 {
     // This method should only be called for local frames
     // (remote frames should be updated via setPrecalculatedName).
     DCHECK(m_thisFrame->isLocalFrame());
 
     // When this method is called, m_uniqueName should be already initialized.
     // This assert helps ensure that early return (a few lines below) won't
     // result in an uninitialized m_uniqueName.
     DCHECK(!m_uniqueName.isNull()
-        || (m_uniqueName.isNull() && m_name.isNull() && !parent()));
+        || (m_uniqueName.isNull() && !parent()));
 
     // Do not recalculate m_uniqueName if there is no real change of m_name.
     // This is not just a performance optimization - other code relies on the
     // assumption that unique name shouldn't change if the assigned name didn't
     // change (i.e. code in content::FrameTreeNode::SetFrameName).
     if (m_name == name)
         return;
 
     m_name = name;
 
+    // https://crbug.com/607205: Make sure m_uniqueName doesn't change after
+    // initial navigation - session history depends on this.
+    if (toLocalFrame(m_thisFrame)->loader().stateMachine()->committedFirstRealDocumentLoad())
+        return;
+
     // Remove our old frame name so it's not considered in calculateUniqueNameForChildFrame
     // and appendUniqueSuffix calls below.
     m_uniqueName = AtomicString();
 
     // Calculate a new unique name based on inputs.
     if (parent()) {
         setUniqueName(
             parent()->tree().calculateUniqueNameForChildFrame(m_thisFrame, name, nullAtom));
     } else if (name.isEmpty() || !uniqueNameExists(name)) {
         // Only main frame can have an empty unique name, so for main frames
         // emptiness guarantees uniquness.
         setUniqueName(name);
     } else {
         setUniqueName(appendUniqueSuffix(name, "<!--framePosition"));
     }
 }
 
 void FrameTree::setPrecalculatedName(const AtomicString& name, const AtomicString& uniqueName)
 {
-    if (!parent()) {
-        DCHECK(uniqueName == name);
-    } else {
-        DCHECK(!uniqueName.isEmpty());
-    }
+    m_name = name;
 
-    m_name = name;
+    // Non-main frames should have a non-empty unique name.
+    DCHECK(!parent() || !uniqueName.isEmpty());
 
     // TODO(lukasza): We would like to assert uniqueness below (i.e. by calling
     // setUniqueName), but
     // 1) uniqueness is currently violated by provisional/old frame pairs.
     // 2) there is an unresolved race between 2 OOPIFs, that can result in a
     //    non-unique |uniqueName| - see https://crbug.com/558680#c14.
     m_uniqueName = uniqueName;
 }
 
 Frame* FrameTree::parent() const
@@ skipping 198 matching lines @@
     // generated in the past on user's disk).  This incremental,
     // backcompatibility-aware approach has resulted so far in the following
     // rather baroque format... :
     //
     //   uniqueName ::= <assignedName> | <generatedName>
     //                 (generatedName is used if assignedName is
     //                 1) non-unique / conflicts with other frame's unique name or
     //                 2) assignedName is empty for a non-main frame)
     //
     //   assignedName ::= value of iframe's name attribute
-    //                 or value assigned to window.name
+    //                 or value assigned to window.name (*before* the first
+    //                    real commit - afterwards unique name stays immutable).
     //
     //   generatedName ::= oldGeneratedName newUniqueSuffix?
     //                  (newUniqueSuffix is only present if oldGeneratedName was
     //                  not unique after all)
     //
     //   oldGeneratedName ::= "<!--framePath //" ancestorChain "/<!--frame" childCount "-->-->"
     //                  (main frame is special - oldGeneratedName for main frame
     //                  is always the frame's assignedName;  oldGeneratedName is
     //                  generated by generateUniqueNameCandidate method).
     //
@@ skipping 263 matching lines @@
 {
     if (!frame) {
         printf("Null input frame\n");
         return;
     }
 
     printFrames(frame->tree().top(), frame, 0);
 }
 
 #endif