Send a subtree of same-process PageStates for back/forward child frames.

content/browser/frame_host/navigation_entry_impl.cc

Index: content/browser/frame_host/navigation_entry_impl.cc
diff --git a/content/browser/frame_host/navigation_entry_impl.cc b/content/browser/frame_host/navigation_entry_impl.cc
index e7736ca298bfffa2df1c14f3e9ed4ee828d72695..0709c485107f751666a3fba912bfc830863e5a65 100644
--- a/content/browser/frame_host/navigation_entry_impl.cc
+++ b/content/browser/frame_host/navigation_entry_impl.cc
@@ -713,7 +713,7 @@ RequestNavigationParams NavigationEntryImpl::ConstructRequestNavigationParams(
     const FrameNavigationEntry& frame_entry,
     bool is_same_document_history_load,
     bool is_history_navigation_in_new_child,
-    const std::map<std::string, bool>& subframe_unique_names,
+    const std::map<std::string, PageState>& subtree_page_states,
     bool has_committed_real_load,
     bool intended_as_new_entry,
     int pending_history_list_offset,
@@ -741,7 +741,7 @@ RequestNavigationParams NavigationEntryImpl::ConstructRequestNavigationParams(
   RequestNavigationParams request_params(
       GetIsOverridingUserAgent(), redirects, GetCanLoadLocalResources(),
       frame_entry.page_state(), GetUniqueID(), is_same_document_history_load,
-      is_history_navigation_in_new_child, subframe_unique_names,
+      is_history_navigation_in_new_child, subtree_page_states,
       has_committed_real_load, intended_as_new_entry, pending_offset_to_send,
       current_offset_to_send, current_length_to_send, IsViewSourceMode(),
       should_clear_history_list());
@@ -864,36 +864,38 @@ FrameNavigationEntry* NavigationEntryImpl::GetFrameEntry(
   return tree_node ? tree_node->frame_entry.get() : nullptr;
 }
 
-std::map<std::string, bool> NavigationEntryImpl::GetSubframeUniqueNames(
+std::map<std::string, PageState> NavigationEntryImpl::GetSubtreePageStates(
     FrameTreeNode* frame_tree_node) const {
-  std::map<std::string, bool> names;
+  std::map<std::string, PageState> states;
   NavigationEntryImpl::TreeNode* tree_node = FindFrameEntry(frame_tree_node);
   if (tree_node) {
-    // Return the names of all immediate children.
-    for (TreeNode* child : tree_node->children) {
-      // Keep track of whether we would be loading about:blank, since the
-      // renderer should be allowed to just commit the initial blank frame if
-      // that was the default URL.  PageState doesn't matter there, because
-      // content injected into about:blank frames doesn't use it.
-      //
-      // Be careful not to rely on FrameNavigationEntry's URLs in this check,
-      // because the committed URL in the browser could be rewritten to
-      // about:blank.
-      // See RenderProcessHostImpl::FilterURL to know which URLs are rewritten.
-      // See https://crbug.com/657896 for details.
-      bool is_about_blank = false;
-      ExplodedPageState exploded_page_state;
-      if (DecodePageState(child->frame_entry->page_state().ToEncodedData(),
-                          &exploded_page_state)) {
-        ExplodedFrameState frame_state = exploded_page_state.top;
-        if (UTF16ToUTF8(frame_state.url_string.string()) == url::kAboutBlankURL)
-          is_about_blank = true;
-      }
-
-      names[child->frame_entry->frame_unique_name()] = is_about_blank;
+    // Return a map of unique name to (same-process) PageStates for the subtree
+    // rooted at |tree_node|.  Use an empty PageState for any cross-process
+    // PageStates, to indicate to the renderer that it should ask the browser
+    // process to handle the navigation.
+    SiteInstance* site_instance = tree_node->frame_entry->site_instance();
+
+    // Start with the immediate children.
+    std::queue<NavigationEntryImpl::TreeNode*> work_queue;
+    for (TreeNode* child : tree_node->children)
+      work_queue.push(child);
+    NavigationEntryImpl::TreeNode* node = nullptr;
+    while (!work_queue.empty()) {
+      node = work_queue.front();
+      work_queue.pop();
+
+      // Use an empty PageState if the FNE has a different SiteInstance.
+      states[node->frame_entry->frame_unique_name()] =
+          node->frame_entry->site_instance() == site_instance
+              ? node->frame_entry->page_state()
+              : PageState();
+
+      // Enqueue any further children and continue.
+      for (TreeNode* child : node->children)
+        work_queue.push(child);
     }
   }
-  return names;
+  return states;
 }
 
 void NavigationEntryImpl::ClearStaleFrameEntriesForNewFrame(