Fix history nav to a script-injected about:blank frame.

content/browser/frame_host/navigation_entry_impl.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_FRAME_HOST_NAVIGATION_ENTRY_IMPL_H_
 #define CONTENT_BROWSER_FRAME_HOST_NAVIGATION_ENTRY_IMPL_H_
 
 #include <stdint.h>
 
-#include <set>
+#include <map>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_vector.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/browser/frame_host/frame_navigation_entry.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/common/frame_message_enums.h"
@@ skipping 158 matching lines @@
       const GURL& dest_url,
       const Referrer& dest_referrer,
       FrameMsg_Navigate_Type::Value navigation_type,
       LoFiState lofi_state,
       const base::TimeTicks& navigation_start) const;
   StartNavigationParams ConstructStartNavigationParams() const;
   RequestNavigationParams ConstructRequestNavigationParams(
       const FrameNavigationEntry& frame_entry,
       bool is_same_document_history_load,
       bool is_history_navigation_in_new_child,
-      const std::set<std::string>& subframe_unique_names,
+      const std::map<std::string, bool>& subframe_unique_names,
       bool has_committed_real_load,
       bool intended_as_new_entry,
       int pending_offset_to_send,
       int current_offset_to_send,
       int current_length_to_send) const;
 
   // Once a navigation entry is committed, we should no longer track several
   // pieces of non-persisted state, as documented on the members below.
   // |frame_entry| is the FrameNavigationEntry for the frame that committed
   // the navigation. It can be null.
@@ skipping 23 matching lines @@
       const GURL& url,
       const Referrer& referrer,
       const PageState& page_state,
       const std::string& method,
       int64_t post_id);
 
   // Returns the FrameNavigationEntry corresponding to |frame_tree_node|, if
   // there is one in this NavigationEntry.
   FrameNavigationEntry* GetFrameEntry(FrameTreeNode* frame_tree_node) const;
 
-  // Returns a set of frame unique names for immediate children of the TreeNode
-  // associated with |frame_tree_node|.  The renderer process will use this list
-  // of names to know whether to ask the browser process for a history item when
-  // new subframes are created during a back/forward navigation.
+  // Returns a map of frame unique names to |is_about_blank| for immediate
+  // children of the TreeNode associated with |frame_tree_node|.  The renderer
+  // process will use this list of names to know whether to ask the browser
+  // process for a history item when new subframes are created during a
+  // back/forward navigation.  (|is_about_blank| can be used to skip the request
+  // if the frame's default URL is about:blank and the history item would be a
+  // no-op.  See https://crbug.com/657896.)
   // TODO(creis): Send a data structure that also contains all corresponding
-  // same-process PageStates for the subtree, so that the renderer process only
-  // needs to ask the browser process to handle the cross-process cases.
+  // same-process PageStates for the whole subtree, so that the renderer process
+  // only needs to ask the browser process to handle the cross-process cases.
   // See https://crbug.com/639842.
-  std::set<std::string> GetSubframeUniqueNames(
+  std::map<std::string, bool> GetSubframeUniqueNames(
       FrameTreeNode* frame_tree_node) const;
 
   // Removes any subframe FrameNavigationEntries that match the unique name of
   // |frame_tree_node|, and all of their children. There should be at most one,
   // since collisions are avoided but leave old FrameNavigationEntries in the
   // tree after their frame has been detached.
   void ClearStaleFrameEntriesForNewFrame(FrameTreeNode* frame_tree_node);
 
   void set_unique_id(int unique_id) {
     unique_id_ = unique_id;
@@ skipping 295 matching lines @@
   // persisted, unless specific data is taken out/put back in at save/restore
   // time (see TabNavigation for an example of this).
   std::map<std::string, base::string16> extra_data_;
 
   DISALLOW_COPY_AND_ASSIGN(NavigationEntryImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_FRAME_HOST_NAVIGATION_ENTRY_IMPL_H_