Ensure that the browser’s copy of page id is in sync with the renderer’s.

content/browser/renderer_host/render_view_host_impl.cc

Index: content/browser/renderer_host/render_view_host_impl.cc
diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index 157e93dbf174566b5a0f5cba315db07e1b9452b7..8ba826a4cd693ac9ecddcb0ff5a26b4d6120c7e3 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc
@@ -11,12 +11,14 @@
 
 #include "base/callback.h"
 #include "base/command_line.h"
+#include "base/debug/crash_logging.h"
 #include "base/debug/trace_event.h"
 #include "base/i18n/rtl.h"
 #include "base/json/json_reader.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/stl_util.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/sys_info.h"
@@ -1088,6 +1090,13 @@ void RenderViewHostImpl::OnRenderProcessGone(int status, int exit_code) {
 }
 
 void RenderViewHostImpl::OnUpdateState(int32 page_id, const PageState& state) {
+  if (page_id_ != page_id) {
+    base::debug::SetCrashKeyValue(
+        "url1", GetMainFrame()->GetLastCommittedURL().possibly_invalid_spec());
+    base::debug::SetCrashKeyValue("id1", base::IntToString(page_id_));
+    base::debug::SetCrashKeyValue("id2", base::IntToString(page_id));
+    CHECK(false);
+  }
   // Without this check, the renderer can trick the browser into using
   // filenames it can't access in a future session restore.
   if (!CanAccessFilesOfPageState(state)) {
@@ -1095,12 +1104,18 @@ void RenderViewHostImpl::OnUpdateState(int32 page_id, const PageState& state) {
     return;
   }
 
-  delegate_->UpdateState(this, page_id, state);
+  delegate_->UpdateState(this, page_id_, state);
 }
 
 void RenderViewHostImpl::OnUpdateTargetURL(int32 page_id, const GURL& url) {
+  if (page_id_ != page_id) {
+    base::debug::SetCrashKeyValue("url1", url.possibly_invalid_spec());
+    base::debug::SetCrashKeyValue("id1", base::IntToString(page_id_));
+    base::debug::SetCrashKeyValue("id2", base::IntToString(page_id));
+    CHECK(false);
+  }
   if (IsRVHStateActive(rvh_state_))
-    delegate_->UpdateTargetURL(page_id, url);
+    delegate_->UpdateTargetURL(page_id_, url);
 
   // Send a notification back to the renderer that we are ready to
   // receive more target urls.