Fix bug when a NavigationThrottle blocks a request during a redirect.

content/browser/frame_host/navigation_handle_impl.cc

Index: content/browser/frame_host/navigation_handle_impl.cc
diff --git a/content/browser/frame_host/navigation_handle_impl.cc b/content/browser/frame_host/navigation_handle_impl.cc
index f9c5561aa4c0b87766c46c2e69ebf3794467f1eb..4927bd3c27d0ce0b94394b2ba157aa5aeb165b4f 100644
--- a/content/browser/frame_host/navigation_handle_impl.cc
+++ b/content/browser/frame_host/navigation_handle_impl.cc
@@ -636,7 +636,6 @@ void NavigationHandleImpl::DidCommitNavigation(
     RenderFrameHostImpl* render_frame_host) {
   DCHECK(!render_frame_host_ || render_frame_host_ == render_frame_host);
   DCHECK_EQ(frame_tree_node_, render_frame_host->frame_tree_node());
-  CHECK_EQ(url_, params.url);
 
   did_replace_entry_ = did_replace_entry;
   method_ = params.method;
@@ -654,8 +653,12 @@ void NavigationHandleImpl::DidCommitNavigation(
   if (params.base_url.spec() == kUnreachableWebDataURL ||
       net_error_code_ != net::OK) {
     state_ = DID_COMMIT_ERROR_PAGE;
+    DCHECK(url_ == params.url ||

[Charlie Reis, 2017/02/24 22:19:10]

nit: We probably shouldn't downgrade these from CHECKs to DCHECKs.

+           std::find(redirect_chain_.begin(), redirect_chain_.end(),
+                     params.url) != redirect_chain_.end());

[Charlie Reis, 2017/02/24 22:19:10]

I don't think this is safe.  According to the bug, params.url is the
pre-redirect URL, but that's what NavigationController will use when creating a
NavigationEntry (which affects what is shown in the omnibox, used for
same-origin checks within NavigationController, etc).

Can we find a way to send a ResourceMsg_ReceivedRedirect instead so that the
renderer knows to commit the right URL?

   } else {
     state_ = DID_COMMIT;
+    DCHECK_EQ(url_, params.url);
   }
 }