Don't update URL bar or SSL icon for pending history navs until they commit.

content/browser/tab_contents/navigation_controller.h

Index: content/browser/tab_contents/navigation_controller.h
diff --git a/content/browser/tab_contents/navigation_controller.h b/content/browser/tab_contents/navigation_controller.h
index a01262d5e33548742656605fccb0e597d683e4b4..c7d9d0318ac68ce206a3a8fc4d843deef48bc7d8 100644
--- a/content/browser/tab_contents/navigation_controller.h
+++ b/content/browser/tab_contents/navigation_controller.h
@@ -78,9 +78,18 @@ class NavigationController {
   // NOTE: This can be NULL!!
   //
   // If you are trying to get the current state of the NavigationController,
-  // this is the method you will typically want to call.
+  // this is the method you will typically want to call.  If you want to display
+  // the active entry to the user (e.g., in the location bar), use
+  // GetVisibleEntry instead.
   NavigationEntry* GetActiveEntry() const;
 
+  // Returns the same entry as GetActiveEntry, except that it ignores pending
+  // history navigation entries.  This should be used when displaying info to
+  // the user, so that the location bar and other indicators do not update for
+  // a back/forward navigation until the pending entry commits.  This approach
+  // guards against URL spoofs on slow history navigations.
+  NavigationEntry* GetVisibleEntry() const;
+
   // Returns the index from which we would go back/forward or reload.  This is
   // the last_committed_entry_index_ if pending_entry_index_ is -1.  Otherwise,
   // it is the pending_entry_index_.