Ignore in-page navigations on the initial blank page.

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index e447c0e24c998ad9f629885282f1963b6fc29e23..0b2497b63049a54855b99f11d9d37c1a15661fc3 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -962,6 +962,13 @@ NavigationType NavigationControllerImpl::ClassifyNavigation(
     // A new entry. We may or may not have a pending entry for the page, and
     // this may or may not be the main frame.
     if (!rfh->GetParent()) {
+      // In-page navigations for the initial about:blank page should be ignored
+      // just like the initial about:blank page itself.  We have no record of
+      // the subframes up to this point, so it's difficult to clone them into a
+      // new in-page entry.
+      if (params.was_within_same_page && !GetLastCommittedEntry())
+        return NAVIGATION_TYPE_NAV_IGNORE;
+
       return NAVIGATION_TYPE_NEW_PAGE;
     }
 
@@ -1346,11 +1353,13 @@ bool NavigationControllerImpl::IsURLInPageNavigation(
     last_committed_url = rfh->GetLastCommittedURL();
   } else {
     NavigationEntry* last_committed = GetLastCommittedEntry();
-    // There must be a last-committed entry to compare URLs to. TODO(avi): When
-    // might Blink say that a navigation is in-page yet there be no last-
-    // committed entry?
+
+    // In most cases, there is a last committed entry to compare URLs to.
+    // The last committed entry might be null when leaving the initial blank
+    // page, even for in-page navigations (e.g., pushState or frament nav).
+    // In these cases, we must trust what the renderer says.
     if (!last_committed)
-      return false;
+      return renderer_says_in_page;
     last_committed_url = last_committed->GetURL();
   }