NTP: don't allow navigateContentWindow to navigate where it pleases.

chrome/browser/ui/search/search_tab_helper.cc

Index: chrome/browser/ui/search/search_tab_helper.cc
diff --git a/chrome/browser/ui/search/search_tab_helper.cc b/chrome/browser/ui/search/search_tab_helper.cc
index 65a7f91dfcb29fec061217fa9cfedd27f0b308e7..4475104a5f5da096595ab786e6421d37f905842a 100644
--- a/chrome/browser/ui/search/search_tab_helper.cc
+++ b/chrome/browser/ui/search/search_tab_helper.cc
@@ -450,6 +450,12 @@ void SearchTabHelper::FocusOmnibox(OmniboxFocusState state) {
 void SearchTabHelper::NavigateToURL(const GURL& url,
                                     WindowOpenDisposition disposition,
                                     bool is_most_visited_item_url) {
+  // Make sure the specified URL is actually on the most visited or suggested
+  // items list. Note that the |is_most_visited_item_url| is apparently

[Charlie Reis, 2016/02/04 18:37:53]

Maybe this second sentence should be a TODO to remove it?  Right now it's just
going to confuse people reading the code, as if it's part of the intended
design.

[dcheng, 2016/02/04 18:41:32]

Hm... I think it's actually kind of important to document that this variable
doesn't mean what a reader thinks it does: my initial impression was that this
would allow me to check |suggestions_items_| or |most_visited_items_| based on
the value of this flag, but that's not true. Do you have suggestions on how to
improve this?

[Charlie Reis, 2016/02/04 18:45:23]

TODO(...): The |is_most_visited_item_url| is apparently meaningless. Can it be
removed?

[dcheng, 2016/02/04 19:05:01]

Done.

+  // meaningless.
+  if (!instant_service_ || !instant_service_->IsValidURLForNavigation(url))
+    return;
+
   if (is_most_visited_item_url) {
     content::RecordAction(
         base::UserMetricsAction("InstantExtended.MostVisitedClicked"));