Fix bug when a NavigationThrottle blocks a request during a redirect.

content/browser/frame_host/navigation_handle_impl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_handle_impl.h"
 
 #include <iterator>
 
 #include "base/debug/dump_without_crashing.h"
 #include "base/logging.h"
@@ skipping 618 matching lines @@
 }
 
 void NavigationHandleImpl::DidCommitNavigation(
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
     bool did_replace_entry,
     const GURL& previous_url,
     NavigationType navigation_type,
     RenderFrameHostImpl* render_frame_host) {
   DCHECK(!render_frame_host_ || render_frame_host_ == render_frame_host);
   DCHECK_EQ(frame_tree_node_, render_frame_host->frame_tree_node());
-  CHECK_EQ(url_, params.url);
 
   did_replace_entry_ = did_replace_entry;
   method_ = params.method;
   has_user_gesture_ = (params.gesture == NavigationGestureUser);
   transition_ = params.transition;
   should_update_history_ = params.should_update_history;
   render_frame_host_ = render_frame_host;
   previous_url_ = previous_url;
   base_url_ = params.base_url;
   socket_address_ = params.socket_address;
   navigation_type_ = navigation_type;
 
   // If an error page reloads, net_error_code might be 200 but we still want to
   // count it as an error page.
   if (params.base_url.spec() == kUnreachableWebDataURL ||
       net_error_code_ != net::OK) {
     state_ = DID_COMMIT_ERROR_PAGE;
+    DCHECK(url_ == params.url ||

[Charlie Reis, 2017/02/24 22:19:10]

nit: We probably shouldn't downgrade these from CHECKs to DCHECKs.

+           std::find(redirect_chain_.begin(), redirect_chain_.end(),
+                     params.url) != redirect_chain_.end());

[Charlie Reis, 2017/02/24 22:19:10]

I don't think this is safe.  According to the bug, params.url is the
pre-redirect URL, but that's what NavigationController will use when creating a
NavigationEntry (which affects what is shown in the omnibox, used for
same-origin checks within NavigationController, etc).

Can we find a way to send a ResourceMsg_ReceivedRedirect instead so that the
renderer knows to commit the right URL?

   } else {
     state_ = DID_COMMIT;
+    DCHECK_EQ(url_, params.url);
   }
 }
 
 void NavigationHandleImpl::Transfer() {
   DCHECK(!IsBrowserSideNavigationEnabled());
   // This is an actual transfer. Inform the NavigationResourceThrottle. This
   // will allow to mark the URLRequest as transferring. When it is marked as
   // transferring, the URLRequest can no longer be cancelled by its original
   // RenderFrame. Instead it will persist until being picked up by the transfer
   // RenderFrame, even if the original RenderFrame is destroyed.
@@ skipping 267 matching lines @@
     if (node->current_url().EqualsIgnoringRef(url_)) {
       if (found_self_reference)
         return true;
       found_self_reference = true;
     }
   }
   return false;
 }
 
 }  // namespace content