Remove a HistoryNode's children when it navigates to a new document.

When a reload occurs (or other inert commits), we leave the history tree alone. However, if iframes are dynamically created, we end up with both the old iframes and the new iframes in the history tree, and we never prune them. Instead, if a different-document inert commit occurs, remove the committing node's children, since the corresponding frames are no longer in the frame tree.

BUG=485385

Review URL: https://codereview.chromium.org/1139033002

Cr-Commit-Position: refs/heads/master@{#329763}

content/renderer/history_controller.cc

@@ -179,6 +179,8 @@ void HistoryController::UpdateForCommit(RenderFrameImpl* frame,
       if (current_entry_) {
         if (HistoryEntry::HistoryNode* node =
                 current_entry_->GetHistoryNodeForFrame(frame)) {
+          if (!navigation_within_page)
+            node->RemoveChildren();
           node->set_item(item);
         }
       }