Ignore in-page navigations on the initial blank page.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 944 matching lines @@
   return true;
 }
 
 NavigationType NavigationControllerImpl::ClassifyNavigation(
     RenderFrameHostImpl* rfh,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params) const {
   if (params.did_create_new_entry) {
     // A new entry. We may or may not have a pending entry for the page, and
     // this may or may not be the main frame.
     if (!rfh->GetParent()) {
+      // In-page navigations for the initial about:blank page should be ignored
+      // just like the initial about:blank page itself.  We have no record of
+      // the subframes up to this point, so it's difficult to clone them into a
+      // new in-page entry.
+      if (params.was_within_same_page && !GetLastCommittedEntry())
+        return NAVIGATION_TYPE_NAV_IGNORE;
+
       return NAVIGATION_TYPE_NEW_PAGE;
     }
 
     // When this is a new subframe navigation, we should have a committed page
     // in which it's a subframe. This may not be the case when an iframe is
     // navigated on a popup navigated to about:blank (the iframe would be
     // written into the popup by script on the main page). For these cases,
     // there isn't any navigation stuff we can do, so just ignore it.
     if (!GetLastCommittedEntry())
       return NAVIGATION_TYPE_NAV_IGNORE;
@@ skipping 364 matching lines @@
 // be in-page.
 bool NavigationControllerImpl::IsURLInPageNavigation(
     const GURL& url,
     bool renderer_says_in_page,
     RenderFrameHost* rfh) const {
   GURL last_committed_url;
   if (rfh->GetParent()) {
     last_committed_url = rfh->GetLastCommittedURL();
   } else {
     NavigationEntry* last_committed = GetLastCommittedEntry();
-    // There must be a last-committed entry to compare URLs to. TODO(avi): When
-    // might Blink say that a navigation is in-page yet there be no last-
-    // committed entry?
+
+    // In most cases, there is a last committed entry to compare URLs to.
+    // The last committed entry might be null when leaving the initial blank
+    // page, even for in-page navigations (e.g., pushState or frament nav).
+    // In these cases, we must trust what the renderer says.
     if (!last_committed)
-      return false;
+      return renderer_says_in_page;
     last_committed_url = last_committed->GetURL();
   }
 
   WebPreferences prefs = rfh->GetRenderViewHost()->GetWebkitPreferences();
   bool is_same_origin = last_committed_url.is_empty() ||
                         // TODO(japhet): We should only permit navigations
                         // originating from about:blank to be in-page if the
                         // about:blank is the first document that frame loaded.
                         // We don't have sufficient information to identify
                         // that case at the moment, so always allow about:blank
@@ skipping 620 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content