[Merge 135] Independently-zoomed, non-main-frame RFHs should ignore pending navigation entries

In WebContentsImpl::GetPendingZoomLevel, it's possible for the
RenderWidgetHost parameter to correspond to an independently
zoomed RenderFrameHost that isn't for a main frame. An example is
when kPdfOopif is enabled.

In theses cases GetPendingZoomLevel should not look at the
pending entry in the RenderFrameHost's NavigationController, as
it will be for the main frame, which is by definition outside
the independently zoomed subtree in this case.

This CL modifies GetPendingZoomLevel so that, if the target
RenderFrameHost isn't a main frame, it ignores any pending
entries on the associated navigation controller.

(cherry picked from commit 1050cd84dd)

Bug: 404286904
Fixed: 405944949
Change-Id: Ia5dca4599ceed8c4b5647c9c2bb50b52966d5162
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6376764
Commit-Queue: James Maclean <wjmaclean@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1436297}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6387576
Cr-Commit-Position: refs/branch-heads/7049@{#1282}
Cr-Branched-From: 2dab7846d0951a552bdc4f350dad497f986e6fed-refs/heads/main@{#1427262}

content/browser/web_contents/web_contents_impl.cc

@@ -8746,12 +8746,20 @@ double WebContentsImpl::GetPendingZoomLevel(RenderWidgetHostImpl* rwh) {
     // and All/FencedFrameAutomaticBeaconBrowserTest.MessageExceedsLengthLimit/
     // fencedframe.
     url = rfh->GetLastCommittedURL();
-  } else {
+  } else if (!rfh->GetParent()) {
+    // Only use the pending entry if `rfh` is a main frame, otherwise the
+    // resulting url is from outside the independently zoomed subtree, and
+    // may result in the wrong zoom level.
     NavigationEntry* pending_entry = rfh->GetController().GetPendingEntry();
     if (!pending_entry) {
       return HostZoomMap::GetZoomLevel(this, rfh->GetGlobalId());
     }
     url = pending_entry->GetURL();
+  } else {
+    // In this case `rfh` is for an independently-zoomed subframe. Call
+    // GetZoomLevel(WebContents*, RenderFrameHost*) in case `rfh` uses temporary
+    // zoom.
+    return HostZoomMap::GetZoomLevel(this, rfh->GetGlobalId());
   }
 #if BUILDFLAG(IS_ANDROID)
   return HostZoomMapForRenderFrameHost(rfh)