Fix LoadDataWithBaseURL reload

On a LoadDataWithBaseURL, renderer reports the history URL
as the URL of the navigation, and is stored in the
NavigationEntry::GetURL field, overwriting the data URL
originally stored there. This causes a crash on a reload
since the data URL has been lost.

Fix this by saving the data URL DocumentState so that
renderer can return it as the URL of the load. This means
that GetURL and GetOriginalURL for a LoadDataWithBaseURL
will now return the data URL, not the history URL.

Also fix WebFrame::LoadData to not create new navigation
for a reload.

BUG=522567

Review URL: https://codereview.chromium.org/1304373007

Cr-Commit-Position: refs/heads/master@{#361481}

2 files changed, 22 insertions, 0 deletions

diff --git a/content/public/renderer/document_state.cc b/content/public/renderer/document_state.cc
index 9add6b0..e8ef655 100644
--- a/content/public/renderer/document_state.cc
+++ b/content/public/renderer/document_state.cc
@@ -19,6 +19,7 @@ DocumentState::DocumentState()
       was_prefetcher_(false),
       was_referred_by_prefetcher_(false),
       was_after_preconnect_request_(false),
+      was_load_data_with_base_url_request_(false),
       load_type_(UNDEFINED_LOAD),
       can_load_local_resources_(false) {
 }
diff --git a/content/public/renderer/document_state.h b/content/public/renderer/document_state.h
index b24c9f1..edb66bd 100644
--- a/content/public/renderer/document_state.h
+++ b/content/public/renderer/document_state.h
@@ -14,6 +14,7 @@
 #include "content/common/content_export.h"
 #include "net/http/http_response_info.h"
 #include "third_party/WebKit/public/web/WebDataSource.h"
+#include "url/gurl.h"
 
 namespace content {
 
@@ -181,6 +182,23 @@ class CONTENT_EXPORT DocumentState
   }
   bool was_after_preconnect_request() { return was_after_preconnect_request_; }
 
+  // For LoadDataWithBaseURL navigations, |was_load_data_with_base_url_request_|
+  // is set to true and |data_url_| is set to the data URL of the navigation.
+  // Otherwise, |was_load_data_with_base_url_request_| is false and |data_url_|
+  // is empty.
+  void set_was_load_data_with_base_url_request(bool value) {
+    was_load_data_with_base_url_request_ = value;
+  }
+  bool was_load_data_with_base_url_request() const {
+    return was_load_data_with_base_url_request_;
+  }
+  const GURL& data_url() const {
+    return data_url_;
+  }
+  void set_data_url(const GURL& data_url) {
+    data_url_ = data_url;
+  }
+
   // Record the nature of this load, for use when histogramming page load times.
   LoadType load_type() const { return load_type_; }
   void set_load_type(LoadType load_type) { load_type_ = load_type; }
@@ -216,6 +234,9 @@ class CONTENT_EXPORT DocumentState
   bool was_referred_by_prefetcher_;
   bool was_after_preconnect_request_;
 
+  bool was_load_data_with_base_url_request_;
+  GURL data_url_;
+
   LoadType load_type_;
 
   scoped_ptr<NavigationState> navigation_state_;