Fix NavigationControllerBrowserTest.SubframeForwardRedirect with PlzNavigate...

Fix NavigationControllerBrowserTest.SubframeForwardRedirect with PlzNavigate and site isolation enabled.

The problem is that NavigationRequest::dest_site_instance_ is set in the constructor of that class. If RenderFrameHostManager::CanSubframeSwapProcess determines that a cross process redirect should happen for the subframe (because of site isolation) then we might need to use a new site instance.

BUG=674734
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_site_isolation

Review-Url: https://codereview.chromium.org/2594263004
Cr-Commit-Position: refs/heads/master@{#442053}

content/browser/frame_host/navigation_controller_impl.cc

@@ -1240,9 +1240,11 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
   if (entry->update_virtual_url_with_url())
     UpdateVirtualURLToURL(entry, params.url);
 
-  // The site instance will normally be the same except during session restore,
-  // when no site instance will be assigned.
+  // The site instance will normally be the same except
+  // 1) session restore, when no site instance will be assigned or
+  // 2) redirect, when the site instance is reset.
   DCHECK(entry->site_instance() == nullptr ||
+         !entry->GetRedirectChain().empty() ||
          entry->site_instance() == rfh->GetSiteInstance());
 
   // Update the existing FrameNavigationEntry to ensure all of its members

content/browser/frame_host/navigation_request.cc

@@ -403,6 +403,10 @@ void NavigationRequest::TransferNavigationHandleOwnership(
 void NavigationRequest::OnRequestRedirected(
     const net::RedirectInfo& redirect_info,
     const scoped_refptr<ResourceResponse>& response) {
+  // If a redirect occurs, the original site instance we thought is the
+  // destination could change.
+  dest_site_instance_ = nullptr;
+
   // If the navigation is no longer a POST, the POST data should be reset.
   if (redirect_info.new_method != "POST")
     common_params_.post_data = nullptr;