4277592f79d3bf61f32dba6ccb558fbd3435c4ac  Subframe is missing from the back/forward list when its src changes before the first load commits

Classified as not security-relevant.
Triage note: Refactors updateForRedirectWithLockedBackForwardList into a createChildItemInParent lambda and now invokes it for a non-main-frame client redirect when !m_currentItem (previously only the non-client-redirect else branch created the child item). Back/forward history-item structure correctness fix for subframe redirects; no memory-safety or policy-bypass evidence.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.

Structural signals: smartptr_member_added (+6.47), null_guard (+2.59), area:Source/WebCore/loader (+2.0)