Make ValidateSpeculativeRenderFrameHostForBug1146573 stricter.

Currently it triggers when ShouldSkipEarlyCommitPendingForCrashedFrame
but it's expected that this leads to same-site-instance frame swaps
because a crashed frame is being replaced. So this is just noise. Also,
it seems that the this bug never occurs when
ShouldSkipEarlyCommitPendingForCrashedFrame is enabled.
https://crrev.com/c/2563047/12 shows that this no longer triggers with
this enabled, there is one failure but it's unrelated to this validation.


Bug: 1146573
Change-Id: Ia79cae066c96ef0e70963a7584f13278eebc8521
Cq-Do-Not-Cancel-Tryjobs: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2563047Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Auto-Submit: Fergal Daly <fergal@chromium.org>
Commit-Queue: Fergal Daly <fergal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#832640}

content/browser/renderer_host/navigation_request.cc

@@ -3231,8 +3231,16 @@ void NavigationRequest::AddOldPageInfoToCommitParamsIfNeeded() {
 }
 
 void NavigationRequest::CommitNavigation() {
-  frame_tree_node_->render_manager()
-      ->ValidateSpeculativeRenderFrameHostForBug1146573();
+  // It's expected that we do a same-SiteInstance local swap here when replacing
+  // a crashed frame if ShouldSkipEarlyCommitPendingForCrashedFrame is
+  // enabled. So don't call in that case.
+  if (!(ShouldSkipEarlyCommitPendingForCrashedFrame() &&
+        frame_tree_node_->render_manager()
+            ->current_frame_host()
+            ->must_be_replaced())) {
+    frame_tree_node_->render_manager()
+        ->ValidateSpeculativeRenderFrameHostForBug1146573();
+  }
   UpdateCommitNavigationParamsHistory();
   DCHECK(NeedsUrlLoader() == !!response_head_ ||
          (was_redirected_ && common_params_->url.IsAboutBlank()));