Version: 52.0.2722.0
OS: All

There are several cases in which we do not create subframe FrameNavigationEntries in OOPIF-enabled modes of Chrome.  This mostly matches the behavior of HistoryController in default Chrome, where WebHistoryItems are not tracked for these frames.  In practice this means we cannot go back/forward in these subframes.

This case also led to crashes in issue 600743 when trying to avoid creating pending entries for transfer navigations in r384009.  We can probably avoid that crash to re-land that CL, and then fix this separately.

Repro 1: No commit in parent.
1) Create an iframe on a page that does not commit (e.g., https://www.google.com/csi for a 204 response).
2) Create a nested iframe inside it (e.g., to https://csreis.github.io/tests).
3) Click the link to simple.html.
Bug: Going back reloads the main frame rather than going back in the subframe.
Note: Same thing happens with a slow URL in the parent, rather than a 204 response.  Same for download.

Repro 2: No record of the parent.
1) Do an in-page navigation to #foo on a page.
2) Create an iframe on the page (e.g., https://csreis.github.io).
3) Go back.
4) Create a nested iframe inside the iframe (e.g., to https://csreis.github.io/tests).
5) Click the link to simple.html.
Bug: Incorrectly triggers the mixed content blocker.  If you use HTTP URLs instead, then going back reloads the main frame rather than going back in the subframe.

Repro 3: Change name of parent.
1) Create an iframe on the page (e.g., https://csreis.github.io).
2) Change the name of the iframe (window.name = "foo" inside the iframe).
3) Create a nested iframe inside the iframe (e.g., to https://csreis.github.io/tests).
4) Click the link to simple.html.
Bug: Going back reloads the main frame rather than going back in the subframe.

These all have the same root cause: not finding the parent frame's FrameNavigationEntry, and thus not having anywhere to put the subframe's FrameNavigationEntry.  See also  issue 607205  (for window.name changes) and issue 524208 (for an initial blank NavigationEntry, since these bugs also apply in that case).