The crash comes from a DCHECK in

void NavigatorImpl::DidStartProvisionalLoad(
...
  if (render_frame_host->navigation_handle()) {
    if (render_frame_host->navigation_handle()->is_transferring()) {
      DCHECK_EQ(url, render_frame_host->navigation_handle()->GetURL());  <-- THIS FAILS
      render_frame_host->navigation_handle()->set_is_transferring(false);
      return;
    }

The test case that triggers the crash above has been introduced in https://codereview.chromium.org/1964303003, but it seems this testcase simply exposes an existing bug in the browser (i.e. this CL didn't touch anything on the browserside).

Adding clamy@ as an FYI for this navigation_handle()-related problem.

Mike, could you please take a look?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b00b14ec9939ab971e7ffa6fccbc5efcbd5bfdf9

commit b00b14ec9939ab971e7ffa6fccbc5efcbd5bfdf9
Author: lukasza <lukasza@chromium.org>
Date: Wed May 11 19:57:50 2016

Test expectation for --site-per-process crash in iframe-upgrade.https.html

Adding a temporary test expectation to keep the FYI bot green,
while we investigate and fix  https://crbug.com/611154 .

BUG= 611154 
TBR=mkwst@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/1972533004
Cr-Commit-Position: refs/heads/master@{#393035}

[modify] https://crrev.com/b00b14ec9939ab971e7ffa6fccbc5efcbd5bfdf9/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process

Note that this issue is most likely due to a mismatch between upgraded and unupgraded URL and should be fixed by  issue 618659 , hence I'm reassigning this to carlosk@ for now. 

Recently, a new layout test was added which fails in the same way: http/tests/security/upgrade-insecure-requests/iframe-upgrade-csp.https.html
(added in https://codereview.chromium.org/2022083002)

The mismatch in this case is:

[9999:9999:0608/171013:8376074366:FATAL:navigator_impl.cc(170)] Check failed: url == render_frame_host->navigation_handle()->GetURL() (https://example.test:8443/security/resources/post-origin-to-parent.html vs. http://example.test:8443/security/resources/post-origin-to-parent.html)
#0 0x000003e80dce base::debug::StackTrace::StackTrace()
#1 0x000003e958fb logging::LogMessage::~LogMessage()
#2 0x000003906981 content::NavigatorImpl::DidStartProvisionalLoad()
#3 0x00000390d6db _ZN3IPC8MessageTI41FrameHostMsg_DidStartProvisionalLoad_MetaSt5tupleIJ4GURLN4base9TimeTicksEEEvE8DispatchIN7content19RenderFrameHostImplESA_vMSA_FvRKS3_RKS5_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#4 0x00000390c3d3 content::RenderFrameHostImpl::OnMessageReceived()

This is currently failing on Site Isolation FYI bots, so I'll similarly disable it until this is fixed.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4b4d0861d8c94df4aa8f107b79a5638d03fa9ac7

commit 4b4d0861d8c94df4aa8f107b79a5638d03fa9ac7
Author: alexmos <alexmos@chromium.org>
Date: Fri Jun 10 16:15:23 2016

Disable iframe-upgrade-csp.https.html on Site Isolation FYI bots.

BUG= 611154 
NOTRY=true

Review-Url: https://codereview.chromium.org/2052313002
Cr-Commit-Position: refs/heads/master@{#399201}

[modify] https://crrev.com/4b4d0861d8c94df4aa8f107b79a5638d03fa9ac7/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4b4d0861d8c94df4aa8f107b79a5638d03fa9ac7

commit 4b4d0861d8c94df4aa8f107b79a5638d03fa9ac7
Author: alexmos <alexmos@chromium.org>
Date: Fri Jun 10 16:15:23 2016

Disable iframe-upgrade-csp.https.html on Site Isolation FYI bots.

BUG= 611154 
NOTRY=true

Review-Url: https://codereview.chromium.org/2052313002
Cr-Commit-Position: refs/heads/master@{#399201}

[modify] https://crrev.com/4b4d0861d8c94df4aa8f107b79a5638d03fa9ac7/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process

Update:
- iframe-upgrade.https.html is not crashing anymore with site-per-process enabled.
- iframe-upgrade-csp.https.html doesn't exist anymore.

I'm also uploading soon a change to remove the added filters.

For reference this was the command line I used to try to run them locally:

third_party/WebKit/Tools/Scripts/run-webkit-tests \
--debug --additional-drt-flag=--site-per-process --no-retry-failures \
--additional-drt-flag=--no-sandbox \
third_party/WebKit/LayoutTests/http/tests/security/upgrade-insecure-requests/iframe-upgrade.https.html \
third_party/WebKit/LayoutTests/http/tests/security/upgrade-insecure-requests/iframe-upgrade-csp.https.html

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/362ff4b976cf4ba10a882218c5f478e09d82dc43

commit 362ff4b976cf4ba10a882218c5f478e09d82dc43
Author: carlosk <carlosk@chromium.org>
Date: Fri Sep 09 19:08:15 2016

Update site-per-process layout test filter.

Two test exclusions removed as one is not crashing anymore and the other
test doesn't exist anymore.

BUG= 611154 

Review-Url: https://codereview.chromium.org/2322163002
Cr-Commit-Position: refs/heads/master@{#417657}

[modify] https://crrev.com/362ff4b976cf4ba10a882218c5f478e09d82dc43/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process