To fix the cross-site post submission bug.

chrome/browser/ui/browser_navigator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/browser_navigator.h"
 
 #include <algorithm>
 
 #include "base/command_line.h"
 #include "base/stringprintf.h"
@@ skipping 217 matching lines @@
   load_url_params.transition_type = params->transition;
   load_url_params.extra_headers = params->extra_headers;
 
   if (params->transferred_global_request_id != GlobalRequestID()) {
     load_url_params.is_renderer_initiated = params->is_renderer_initiated;
     load_url_params.transferred_global_request_id =
         params->transferred_global_request_id;
   } else if (params->is_renderer_initiated) {
     load_url_params.is_renderer_initiated = true;
   }
+  if (params->transition == content::PAGE_TRANSITION_FORM_SUBMIT) {
+    load_url_params.load_type =
+        content::NavigationController::LOAD_TYPE_BROWSER_INITIATED_HTTP_POST;

[Charlie Reis, 2012/11/05 16:21:40]

This seems wrong to me.  BROWSER_INITIATED_HTTP_POST is for form submissions
from Android Webviews.  This is more likely a renderer-initiated POST.

+    load_url_params.request = params->request;
+  }
   target_contents->GetController().LoadURLWithParams(load_url_params);
 }
 
 // This class makes sure the Browser object held in |params| is made visible
 // by the time it goes out of scope, provided |params| wants it to be shown.
 class ScopedBrowserDisplayer {
  public:
   explicit ScopedBrowserDisplayer(chrome::NavigateParams* params)
       : params_(params) {
   }
@@ skipping 337 matching lines @@
   bool reverse_on_redirect = false;
   content::BrowserURLHandler::GetInstance()->RewriteURLIfNecessary(
       &rewritten_url, browser_context, &reverse_on_redirect);
 
   // Some URLs are mapped to uber subpages. Do not allow them in incognito.
   return !(rewritten_url.scheme() == chrome::kChromeUIScheme &&
            rewritten_url.host() == chrome::kChromeUIUberHost);
 }
 
 }  // namespace chrome