Fix SSL certificate being wrong in the intended_as_new_entry fase of NAVIGATION_TYPE_EXISTING_PAGE.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 1117 matching lines @@
   // entry instead of looking at the pending entry, because the pending entry
   // does not have any subframe history items.
   if (is_in_page && GetLastCommittedEntry()) {
     FrameNavigationEntry* frame_entry = new FrameNavigationEntry(
         params.frame_unique_name, params.item_sequence_number,
         params.document_sequence_number, rfh->GetSiteInstance(), nullptr,
         params.url, params.referrer, params.method, params.post_id);
     new_entry = GetLastCommittedEntry()->CloneAndReplace(
         frame_entry, true, rfh->frame_tree_node(),
         delegate_->GetFrameTree()->root());
+    CHECK_EQ(new_entry->GetURL().GetOrigin(), params.url.GetOrigin());

[estark, 2017/02/21 19:39:41]

optional nit: if we think the only way this can happen is a misbehaving
renderer, it might be nicer to kill the renderer with ReceivedBadMessage

[jam, 2017/02/21 20:22:45]

I added this because I don't see a way for this to happen, and none of the crash
reports you added are sending this back (although admittedly the volume isn't
huge). But I figured since my previous strategy of assuming a cert can be reused
from an entry has caused a bunch of bugs, I want to be explicit in CHECKing this
assumption everywhere else. If it fires, then we can drill more into whether
it's a bug or a bad renderer.

 
     // We expect |frame_entry| to be owned by |new_entry|.  This should never
     // fail, because it's the main frame.
     CHECK(frame_entry->HasOneRef());
 
     update_virtual_url = new_entry->update_virtual_url_with_url();
 
     MaybeDumpCopiedNonSameOriginEntry("New page navigation", params, is_in_page,
                                       GetLastCommittedEntry());
   }
@@ skipping 96 matching lines @@
   // in https://crbug.com/596707.
 
   NavigationEntryImpl* entry;
   if (params.intended_as_new_entry) {
     // This was intended as a new entry but the pending entry was lost in the
     // meanwhile and no new page was created. We are stuck at the last committed
     // entry.
     entry = GetLastCommittedEntry();
     MaybeDumpCopiedNonSameOriginEntry("Existing page navigation", params,
                                       is_in_page, entry);
+    CHECK(!is_in_page);

[estark, 2017/02/21 19:39:41]

ditto about ReceivedBadMessage

+    entry->GetSSL() = handle->ssl_status();
   } else if (params.nav_entry_id) {
     // This is a browser-initiated navigation (back/forward/reload).
     entry = GetEntryWithUniqueID(params.nav_entry_id);
 
     if (is_in_page) {
       // There's no SSLStatus in the NavigationHandle for in-page navigations,
       // so normally we leave |entry|'s SSLStatus as is. However if this was a
       // restored in-page navigation entry, then it won't have an SSLStatus. So
       // we need to copy over the SSLStatus from the entry that navigated it.
       NavigationEntryImpl* last_entry = GetLastCommittedEntry();
@@ skipping 922 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content