Inherit nav_entry_id in subframes and fix check in UpdateStateForFrame.
Newly created subframes weren't having their nav_entry_id assigned, and
it's possible for an UpdateState message to arrive for a frame after
its FrameNavigationEntry has been replaced by one in a different
SiteInstance.
This also adds test coverage for assigning nav_entry_ids.
BUG=545219, 369661
TEST=No more UpdateStateForFrame crashes.
Review URL: https://codereview.chromium.org/1437643004
Cr-Commit-Position: refs/heads/master@{#359031}
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index c07fa27..bfae0c2 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -4145,7 +4145,13 @@
if (!frame_entry)
return;
- CHECK_EQ(frame_entry->site_instance(), rfhi->GetSiteInstance());
+ // The SiteInstance might not match if we do a cross-process navigation with
+ // replacement (e.g., auto-subframe), in which case the swap out of the old
+ // RenderFrameHost runs in the background after the old FrameNavigationEntry
+ // has already been replaced and destroyed.
+ if (frame_entry->site_instance() != rfhi->GetSiteInstance())
+ return;
+
if (page_state == frame_entry->page_state())
return; // Nothing to update.
