Fix a crash when a frame was inserted into a popup and navigated. I added a...

chrome/browser/navigation_controller_unittest.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "base/string_util.h"
 #include "chrome/browser/browser_type.h"
 #include "chrome/browser/navigation_controller.h"
 #include "chrome/browser/navigation_entry.h"
@@ skipping 856 matching lines @@
 
   // The new entry should be appended.
   EXPECT_EQ(2, contents->controller()->GetEntryCount());
 
   // New entry should refer to the new page, but the old URL (entries only
   // reflect the toplevel URL).
   EXPECT_EQ(url1, details.entry->url());
   EXPECT_EQ(params.page_id, details.entry->page_id());
 }
 
+// Some pages create a popup, then write an iframe into it. This causes a
+// subframe navigation without having any committed entry. Such navigations
+// just get thrown on the ground, but we shouldn't crash.
+TEST_F(NavigationControllerTest, SubframeOnEmptyPage) {
+  TestNotificationTracker notifications;
+  RegisterForAllNavNotifications(&notifications, contents->controller());
+
+  // Navigation controller currently has no entries.
+  const GURL url("test1:foo2");
+  ViewHostMsg_FrameNavigate_Params params;
+  params.page_id = 1;
+  params.url = url;
+  params.transition = PageTransition::AUTO_SUBFRAME;
+  params.should_update_history = false;
+  params.gesture = NavigationGestureAuto;
+  params.is_post = false;
+
+  NavigationController::LoadCommittedDetails details;
+  EXPECT_FALSE(contents->controller()->RendererDidNavigate(params, false,
+                                                           &details));
+  EXPECT_EQ(0, notifications.size());
+}
+
 // Auto subframes are ones the page loads automatically like ads. They should
 // not create new navigation entries.
 TEST_F(NavigationControllerTest, AutoSubframe) {
   TestNotificationTracker notifications;
   RegisterForAllNavNotifications(&notifications, contents->controller());
 
   const GURL url1("test1:foo1");
   contents->CompleteNavigationAsRenderer(0, url1);
   EXPECT_TRUE(notifications.Check1AndReset(NOTIFY_NAV_ENTRY_COMMITTED));
 
@@ skipping 527 matching lines @@
 
   helper_.AssertSingleWindowWithSingleTab(windows_, 2);
   helper_.AssertTabEquals(0, 1, 2, *(windows_[0]->tabs[0]));
 
   TabNavigation nav(0, url0, std::wstring(), std::string(),
                     PageTransition::LINK);
   helper_.AssertNavigationEquals(nav, windows_[0]->tabs[0]->navigations[0]);
   nav.url = url2;
   helper_.AssertNavigationEquals(nav, windows_[0]->tabs[0]->navigations[1]);
 }