Fix window.open crashes on custom tabs

chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTab.java

Index: chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTab.java
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTab.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTab.java
index 9f65073264402861c006d753fbfa33816cf76648..c577a34d27c3ef149f0c99d0cb327ca479023140 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTab.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTab.java
@@ -7,6 +7,7 @@ package org.chromium.chrome.browser.customtabs;
 import android.content.Context;
 import android.content.Intent;
 import android.content.pm.ResolveInfo;
+import android.graphics.Rect;
 import android.os.IBinder;
 import android.os.SystemClock;
 import android.os.TransactionTooLargeException;
@@ -342,4 +343,34 @@ public class CustomTab extends ChromeTab {
         }
     }
 
+    @Override
+    protected TabChromeWebContentsDelegateAndroid createWebContentsDelegate() {
+        return new TabChromeWebContentsDelegateAndroidImpl() {
+            private String mTargetUrl;
+
+            @Override
+            public boolean shouldResumeRequestsForCreatedWindow() {
+                return true;
+            }
+
+            @Override
+            public void webContentsCreated(WebContents sourceWebContents, long openerRenderFrameId,
+                    String frameName, String targetUrl, WebContents newWebContents) {
+                super.webContentsCreated(
+                        sourceWebContents, openerRenderFrameId, frameName, targetUrl,
+                        newWebContents);
+                mTargetUrl = targetUrl;
+            }
+
+            @Override
+            public boolean addNewContents(WebContents sourceWebContents, WebContents webContents,
+                    int disposition, Rect initialPosition, boolean userGesture) {
+                assert mTargetUrl != null;
+                loadUrlAndTrackFromTimestamp(
+                        new LoadUrlParams(mTargetUrl), SystemClock.elapsedRealtime());
+                mTargetUrl = null;
+                return false;
+            }
+        };
+    }
 }