Fix bug when a NavigationThrottle blocks a request during a redirect.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 1448dd8939f48fe69578f4ecea6344312c1111fc..77ab35689a47006b105ef581dbc6ce990654a944 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -3406,6 +3406,21 @@ RenderFrameHostImpl::TakeNavigationHandleForCommit(
     return std::move(navigation_handle_);
   }
 
+  // When PlzNavigate is disabled and the navigation fails during a redirect,
+  // blink doesn't know about the redirect and tries to commit an error page
+  // with the post-redirect url.

[Charlie Reis, 2017/02/24 22:19:10]

This doesn't match what's written on the bug:

"Hence the renderer never learns of the redirect, so the provisional load fails
on the renderer side with the pre-redirect URL.

This means that the error page is also committed under the pre-redirect URL,
which causes a mismatch in TakeNavigationHandleForCommit, because the
NavigationHandle already has the post-redirect URL."

Did you mean "pre-redirect url" on line 3411?

+  // TODO(arthursonzogni, clamy) Remove this code once PlzNavigate is launched
+  // or when this problem is solved.
+  bool is_error_page =
+      params.url_is_unreachable || params.http_status_code != net::OK;
+  if (!IsBrowserSideNavigationEnabled() && is_error_page &&
+      navigation_handle_) {
+    for (const GURL& url : navigation_handle_->GetRedirectChain()) {
+      if (url == params.url)
+        return std::move(navigation_handle_);
+    }
+  }
+
   // If the URL does not match what the NavigationHandle expects, treat the
   // commit as a new navigation. This can happen when loading a Data
   // navigation with LoadDataWithBaseURL.