To fix the cross-site post submission bug.

chrome/browser/ui/browser_navigator.cc

Index: chrome/browser/ui/browser_navigator.cc
diff --git a/chrome/browser/ui/browser_navigator.cc b/chrome/browser/ui/browser_navigator.cc
index 80fb7d5cf68f1c3418539457d4db426a48e17672..5226d0210cd3fc123142d92058ddad45293707b2 100644
--- a/chrome/browser/ui/browser_navigator.cc
+++ b/chrome/browser/ui/browser_navigator.cc
@@ -235,6 +235,11 @@ void LoadURLInContents(WebContents* target_contents,
   } else if (params->is_renderer_initiated) {
     load_url_params.is_renderer_initiated = true;
   }
+  if (params->transition == content::PAGE_TRANSITION_FORM_SUBMIT) {
+    load_url_params.load_type =
+        content::NavigationController::LOAD_TYPE_BROWSER_INITIATED_HTTP_POST;

[Charlie Reis, 2012/11/05 16:21:40]

This seems wrong to me.  BROWSER_INITIATED_HTTP_POST is for form submissions
from Android Webviews.  This is more likely a renderer-initiated POST.

+    load_url_params.request = params->request;
+  }
   target_contents->GetController().LoadURLWithParams(load_url_params);
 }