Fix SSL certificate being wrong in the intended_as_new_entry fase of NAVIGATION_TYPE_EXISTING_PAGE.

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index 7daa46f99106e1922ed9757feb41d88384118679..722042328935dbd1defdd91a6a1b91d284ae6f1a 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -1135,6 +1135,7 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
     new_entry = GetLastCommittedEntry()->CloneAndReplace(
         frame_entry, true, rfh->frame_tree_node(),
         delegate_->GetFrameTree()->root());
+    CHECK_EQ(new_entry->GetURL().GetOrigin(), params.url.GetOrigin());

[estark, 2017/02/21 19:39:41]

optional nit: if we think the only way this can happen is a misbehaving
renderer, it might be nicer to kill the renderer with ReceivedBadMessage

[jam, 2017/02/21 20:22:45]

I added this because I don't see a way for this to happen, and none of the crash
reports you added are sending this back (although admittedly the volume isn't
huge). But I figured since my previous strategy of assuming a cert can be reused
from an entry has caused a bunch of bugs, I want to be explicit in CHECKing this
assumption everywhere else. If it fires, then we can drill more into whether
it's a bug or a bad renderer.

 
     // We expect |frame_entry| to be owned by |new_entry|.  This should never
     // fail, because it's the main frame.
@@ -1251,6 +1252,8 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
     entry = GetLastCommittedEntry();
     MaybeDumpCopiedNonSameOriginEntry("Existing page navigation", params,
                                       is_in_page, entry);
+    CHECK(!is_in_page);

[estark, 2017/02/21 19:39:41]

ditto about ReceivedBadMessage

+    entry->GetSSL() = handle->ssl_status();
   } else if (params.nav_entry_id) {
     // This is a browser-initiated navigation (back/forward/reload).
     entry = GetEntryWithUniqueID(params.nav_entry_id);