Fix cross-site subframe navigations that transfer back to original RFH.

content/browser/frame_host/render_frame_host_manager.h

Index: content/browser/frame_host/render_frame_host_manager.h
diff --git a/content/browser/frame_host/render_frame_host_manager.h b/content/browser/frame_host/render_frame_host_manager.h
index 7a1e626a6a3a3a9c922cbfe830cc439a235a0f6f..9a7d3ad05e2731212b9050df87f51c47d4ab81b8 100644
--- a/content/browser/frame_host/render_frame_host_manager.h
+++ b/content/browser/frame_host/render_frame_host_manager.h
@@ -596,7 +596,8 @@ class CONTENT_EXPORT RenderFrameHostManager
       SiteInstance* candidate_instance,
       ui::PageTransition transition,
       bool dest_is_restore,
-      bool dest_is_view_source_mode);
+      bool dest_is_view_source_mode,
+      bool was_server_redirect);
 
   // Returns a descriptor of the appropriate SiteInstance object for the given
   // |dest_url|, possibly reusing the current, source or destination
@@ -620,7 +621,8 @@ class CONTENT_EXPORT RenderFrameHostManager
       ui::PageTransition transition,
       bool dest_is_restore,
       bool dest_is_view_source_mode,
-      bool force_browsing_instance_swap);
+      bool force_browsing_instance_swap,
+      bool was_server_redirect);
 
   // Converts a SiteInstanceDescriptor to the actual SiteInstance it describes.
   // If a |candidate_instance| is provided (is not nullptr) and it matches the
@@ -750,7 +752,8 @@ class CONTENT_EXPORT RenderFrameHostManager
   // Returns true if a subframe can navigate cross-process.
   bool CanSubframeSwapProcess(const GURL& dest_url,
                               SiteInstance* source_instance,
-                              SiteInstance* dest_instance);
+                              SiteInstance* dest_instance,
+                              bool was_server_redirect);
 
   // For use in creating RenderFrameHosts.
   FrameTreeNode* frame_tree_node_;