Avoid crash in HistoryNode::CloneAndReplace with out-of-process iframes.

content/browser/site_per_process_browsertest.cc

Index: content/browser/site_per_process_browsertest.cc
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 9c9c0f2f05c6805d133c20fe6a0a725a15077d01..2c5848e3437ae3e786a8b9abbcca36bca234e7f5 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -1318,4 +1318,39 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, CrossSiteDidStopLoading) {
   EXPECT_EQ(url, observer.last_navigation_url());
 }
 
+// Ensure that the renderer does not crash when navigating a frame that has a
+// sibling RemoteFrame.  See https://crbug.com/426953.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
+                       NavigateWithSiblingRemoteFrame) {
+  GURL main_url(embedded_test_server()->GetURL(

[alexmos, 2015/02/19 00:33:08]

Nit: git cl format put the line break after "main_url(" on the same line in my
own test.

[Charlie Reis, 2015/02/19 00:36:52]

Thanks.  Ran git cl format.

+                    "/frame_tree/page_with_two_frames.html"));
+  NavigateToURL(shell(), main_url);
+
+  // It is safe to obtain the root frame tree node here, as it doesn't change.
+  FrameTreeNode* root =
+      static_cast<WebContentsImpl*>(shell()->web_contents())->
+          GetFrameTree()->root();
+  TestNavigationObserver observer(shell()->web_contents());
+
+  // Make sure the first frame is out of process.
+  ASSERT_EQ(2U, root->child_count());
+  FrameTreeNode* node2 = root->child_at(0);
+  EXPECT_NE(root->current_frame_host()->GetSiteInstance(),
+            node2->current_frame_host()->GetSiteInstance());
+
+  // Make sure the second frame is in the parent's process.
+  FrameTreeNode* node3 = root->child_at(1);
+  EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
+            node3->current_frame_host()->GetSiteInstance());
+
+  // Navigate the second iframe (node3) to a URL in its own process.
+  GURL title_url = embedded_test_server()->GetURL("/title2.html");
+  NavigateFrameToURL(node3, title_url);
+  EXPECT_TRUE(observer.last_navigation_succeeded());
+  EXPECT_EQ(title_url, observer.last_navigation_url());
+  EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
+            node3->current_frame_host()->GetSiteInstance());
+  EXPECT_TRUE(node3->current_frame_host()->IsRenderFrameLive());
+}
+
 }  // namespace content