Fix navigations after HTML5 history push losing their SSL status.

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index 7efd66c4e1536e8060d3047c8d0082963bebccd4..c0ddb1b926e0af03b8758c235c8e8a4026164be5 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -1174,8 +1174,11 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
     entry = GetEntryWithUniqueID(params.nav_entry_id);
 
     // Needed for the restore case, where the serialized NavigationEntry doesn't
-    // have the SSL state.
-    entry->GetSSL() = handle->ssl_status();
+    // have the SSL state. Note that for in-page navigation, there's no
+    // SSLStatus in the NavigationHandle so don't overwrite the existing entry's
+    // SSLStatus.
+    if (!is_in_page)
+      entry->GetSSL() = handle->ssl_status();
   } else {
     // This is renderer-initiated. The only kinds of renderer-initated
     // navigations that are EXISTING_PAGE are reloads and location.replace,