DCHECK that a subframe is in the same BrowsingInstance as its parent.

This CL adds a DCHECK to
RenderFrameHostManager::GetFrameHostForNavigation to make sure that the
|dest_site_instance| computed earlier is in the same BrowsingInstance as
the frame's parent:

    DCHECK(!parent || dest_site_instance->IsRelatedSiteInstance(
                                            parent->GetSiteInstance()));

Bug: 1107269
Change-Id: I89b79e93e8435f12a51bf3e49472a44ce7ddb47e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2347074
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#796962}

content/browser/frame_host/render_frame_host_manager.cc

@@ -683,6 +683,12 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
   scoped_refptr<SiteInstance> dest_site_instance =
       GetSiteInstanceForNavigationRequest(request);
 
+  // A subframe should always be in the same BrowsingInstance as the parent
+  // (see also https://crbug.com/1107269).
+  RenderFrameHostImpl* parent = frame_tree_node_->parent();
+  DCHECK(!parent ||
+         dest_site_instance->IsRelatedSiteInstance(parent->GetSiteInstance()));
+
   // The SiteInstance determines whether to switch RenderFrameHost or not.
   bool use_current_rfh = current_site_instance == dest_site_instance;