NTP: don't allow navigateContentWindow to navigate where it pleases.

chrome/browser/ui/search/search_tab_helper.cc

Index: chrome/browser/ui/search/search_tab_helper.cc
diff --git a/chrome/browser/ui/search/search_tab_helper.cc b/chrome/browser/ui/search/search_tab_helper.cc
index 65a7f91dfcb29fec061217fa9cfedd27f0b308e7..fb2a6b43515fe57deacaac65d3ba26052b05f9be 100644
--- a/chrome/browser/ui/search/search_tab_helper.cc
+++ b/chrome/browser/ui/search/search_tab_helper.cc
@@ -450,6 +450,15 @@ void SearchTabHelper::FocusOmnibox(OmniboxFocusState state) {
 void SearchTabHelper::NavigateToURL(const GURL& url,
                                     WindowOpenDisposition disposition,
                                     bool is_most_visited_item_url) {
+  // Make sure the specified URL is actually on the most visited or suggested
+  // items list.
+  // TODO(trieb) The |is_most_visited_item_url| is meaningless: the way it's

[Charlie Reis, 2016/02/04 19:10:04]

nit: treib  (I'm sensitive to ie/ei as well.)  :)
nit: Add colon after close paren.

[dcheng, 2016/02/04 19:12:38]

Done.

+  // currently set by the renderer means it can't be used to decide which list
+  // of items (most visited or suggestions) to use for the validation check. Can
+  // it be removed?
+  if (!instant_service_ || !instant_service_->IsValidURLForNavigation(url))
+    return;
+
   if (is_most_visited_item_url) {
     content::RecordAction(
         base::UserMetricsAction("InstantExtended.MostVisitedClicked"));