Send a subtree of same-process PageStates for back/forward child frames.

content/browser/frame_host/navigation_entry_impl.h

Index: content/browser/frame_host/navigation_entry_impl.h
diff --git a/content/browser/frame_host/navigation_entry_impl.h b/content/browser/frame_host/navigation_entry_impl.h
index 4b93695b791e5620e2aed4b2cb1d88055bd07e9e..44c2e3a3d119a439bd4a826fe7e055d73b4805f8 100644
--- a/content/browser/frame_host/navigation_entry_impl.h
+++ b/content/browser/frame_host/navigation_entry_impl.h
@@ -187,7 +187,7 @@ class CONTENT_EXPORT NavigationEntryImpl
       const FrameNavigationEntry& frame_entry,
       bool is_same_document_history_load,
       bool is_history_navigation_in_new_child,
-      const std::map<std::string, bool>& subframe_unique_names,
+      const std::map<std::string, PageState>& subtree_page_states,
       bool has_committed_real_load,
       bool intended_as_new_entry,
       int pending_offset_to_send,
@@ -232,18 +232,24 @@ class CONTENT_EXPORT NavigationEntryImpl
   // there is one in this NavigationEntry.
   FrameNavigationEntry* GetFrameEntry(FrameTreeNode* frame_tree_node) const;
 
-  // Returns a map of frame unique names to |is_about_blank| for immediate
-  // children of the TreeNode associated with |frame_tree_node|.  The renderer
-  // process will use this list of names to know whether to ask the browser
-  // process for a history item when new subframes are created during a
-  // back/forward navigation.  (|is_about_blank| can be used to skip the request
-  // if the frame's default URL is about:blank and the history item would be a
-  // no-op.  See https://crbug.com/657896.)
-  // TODO(creis): Send a data structure that also contains all corresponding
-  // same-process PageStates for the whole subtree, so that the renderer process
-  // only needs to ask the browser process to handle the cross-process cases.
-  // See https://crbug.com/639842.
-  std::map<std::string, bool> GetSubframeUniqueNames(
+  // Returns a map of frame unique names to PageStates for the subtree of
+  // FrameNavigationEntries underneath |frame_tree_node|.  This map contains
+  // names for every frame in the subtree, and valid PageStates for those frames
+  // that should load in the same SiteInstance.  Cross-SiteInstance frames are
+  // given empty PageStates here.
+  //
+  // The renderer process uses this list of names to know whether there is a
+  // history item to use when new subframes are created during a back/forward
+  // navigation.  If the corresponding PageState is valid, the renderer can
+  // directly load it without asking the browser.  If the PageState is empty,
+  // it corresponds to an out-of-process iframe and the renderer asks the
+  // browser process to navigate that frame instead.
+  //
+  // TODO(creis): When the SiteInstance is missing, such as after restore, this
+  // causes the browser to send PageStates to the renderer even when they should
+  // be destined for an OOPIF.  Persist SiteInstance relationships to prevent
+  // this.  See https://crbug.com/14987.
+  std::map<std::string, PageState> GetSubtreePageStates(
       FrameTreeNode* frame_tree_node) const;
 
   // Removes any subframe FrameNavigationEntries that match the unique name of