NTP: don't allow navigateContentWindow to navigate where it pleases.

chrome/browser/search/instant_service.h

Index: chrome/browser/search/instant_service.h
diff --git a/chrome/browser/search/instant_service.h b/chrome/browser/search/instant_service.h
index e7118988619044ec7718d7c6770f264781de27b9..49f37d3b413ad86fa4db7222e0260287a5dbb016 100644
--- a/chrome/browser/search/instant_service.h
+++ b/chrome/browser/search/instant_service.h
@@ -87,6 +87,10 @@ class InstantService : public KeyedService,
   // Sends the current set of search URLs to a renderer process.
   void SendSearchURLsToRenderer(content::RenderProcessHost* rph);
 
+  // Used to validate that the URL the NTP is trying to navigate to is actually
+  // a URL on the most visited items / suggested items list.
+  bool IsValidURLForNavigation(const GURL& url) const;
+
   InstantSearchPrerenderer* instant_search_prerenderer() {
     return instant_prerenderer_.get();
   }