This bug is a follow-up to https://chromium-review.googlesource.com/c/chromium/src/+/713654/18/chrome/browser/task_manager/task_manager_browsertest.cc#b950
In the CL above, we plan to prevent session history navigations in subframes created (or recreated) dynamically (i.e. via javascript, not via static html). cross_site_iframe_factory.html creates subframes via javascript and so such subframes will stop being considered for history navigations (the CL above disables parts of some such tests - e.g. TaskManagerOOPIFBrowserTest.SubframeHistoryNavigation).
One option to address this would be to rewrite cross_site_iframe_factory.html as a embedded_test_server's handler (e.g. similar to content::SetupCrossSiteRedirector) that generates cross-origin subframes within static html.