Fix bug when a NavigationThrottle blocks a request during a redirect.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 3388 matching lines @@
         params.url, params.redirects, frame_tree_node_, is_renderer_initiated,
         params.was_within_same_page, base::TimeTicks::Now(),
         pending_nav_entry_id, false);  // started_from_context_menu
   }
 
   // Determine if the current NavigationHandle can be used.
   if (navigation_handle_ && navigation_handle_->GetURL() == params.url) {
     return std::move(navigation_handle_);
   }
 
+  // When PlzNavigate is disabled and the navigation fails during a redirect,
+  // blink doesn't know about the redirect and tries to commit an error page
+  // with the post-redirect url.

[Charlie Reis, 2017/02/24 22:19:10]

This doesn't match what's written on the bug:

"Hence the renderer never learns of the redirect, so the provisional load fails
on the renderer side with the pre-redirect URL.

This means that the error page is also committed under the pre-redirect URL,
which causes a mismatch in TakeNavigationHandleForCommit, because the
NavigationHandle already has the post-redirect URL."

Did you mean "pre-redirect url" on line 3411?

+  // TODO(arthursonzogni, clamy) Remove this code once PlzNavigate is launched
+  // or when this problem is solved.
+  bool is_error_page =
+      params.url_is_unreachable || params.http_status_code != net::OK;
+  if (!IsBrowserSideNavigationEnabled() && is_error_page &&
+      navigation_handle_) {
+    for (const GURL& url : navigation_handle_->GetRedirectChain()) {
+      if (url == params.url)
+        return std::move(navigation_handle_);
+    }
+  }
+
   // If the URL does not match what the NavigationHandle expects, treat the
   // commit as a new navigation. This can happen when loading a Data
   // navigation with LoadDataWithBaseURL.
   //
   // TODO(csharrison): Data navigations loaded with LoadDataWithBaseURL get
   // reset here, because the NavigationHandle tracks the URL but the params.url
   // tracks the data. The trick of saving the old entry ids for these
   // navigations should go away when this is properly handled.
   // See crbug.com/588317.
   int entry_id_for_data_nav = 0;
@@ skipping 28 matching lines @@
   // There is no pending NavigationEntry in these cases, so pass 0 as the
   // pending_nav_entry_id. If the previous handle was a prematurely aborted
   // navigation loaded via LoadDataWithBaseURL, propagate the entry id.
   return NavigationHandleImpl::Create(
       params.url, params.redirects, frame_tree_node_, is_renderer_initiated,
       params.was_within_same_page, base::TimeTicks::Now(),
       entry_id_for_data_nav, false);  // started_from_context_menu
 }
 
 }  // namespace content