Fix DCHECK in history_backend by ensuring we clear redirect tracking state whenever the RenderView is told that a provisional load has started for the main frame.

The DCHECK(params->referrer == params->redirects[0]) was firing because:
a) page A was loaded, triggered WillPerformClientRedirect
b) after the provisional load started for the destination page of A's client redirect, but before this load was committed, the browser makes a Navigation request for page B.
c) When page B's load is committed, the RenderView's completed_client_redirect_src_ was still set, resulting in a CLIENT_REDIRECT transition type and forwarding the src value through params->referrer -- but params->redirects was now completely unrelated. Kaboom.

This fix should be general enough to handle cases (that are relatively likely in the wild) where WebKit legitimately cancels the redirect, instead of just the browser doing so. Note we can't depend on dispatchDidCancelClientRedirect because we get that callback on both completion and cancellation of a client redirect.

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@251 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 6 insertions, 1 deletions

diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 519e37d..28a9195 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -1015,6 +1015,7 @@ void RenderView::UpdateURL(WebFrame* frame) {
     // the page contained a client redirect (meta refresh, document.loc...),
     // so we set the referrer and transition to match.
     if (completed_client_redirect_src_.is_valid()) {
+      DCHECK(completed_client_redirect_src_ == params.redirects[0]);
       params.referrer = completed_client_redirect_src_;
       params.transition = static_cast<PageTransition::Type>(
           params.transition | PageTransition::CLIENT_REDIRECT);
@@ -1146,8 +1147,12 @@ void RenderView::DidStartProvisionalLoadForFrame(
     WebView* webview,
     WebFrame* frame,
     NavigationGesture gesture) {
-  if (webview->GetMainFrame() == frame)
+  if (webview->GetMainFrame() == frame) {
     navigation_gesture_ = gesture;
+    
+    // Make sure redirect tracking state is clear for the new load.
+    completed_client_redirect_src_ = GURL();
+  }
 
   Send(new ViewHostMsg_DidStartProvisionalLoadForFrame(
        routing_id_, webview->GetMainFrame() == frame,