Don't leave aborted URLs in the omnibox unless we're on a new tab.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
 #include "base/bind.h"
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"  // Temporary
@@ skipping 411 matching lines @@
   if (transient_entry_index_ != -1)
     return entries_[transient_entry_index_].get();
   // The pending entry is safe to return for new (non-history), browser-
   // initiated navigations.  Most renderer-initiated navigations should not
   // show the pending entry, to prevent URL spoof attacks.
   //
   // We make an exception for renderer-initiated navigations in new tabs, as
   // long as no other page has tried to access the initial empty document in
   // the new tab.  If another page modifies this blank page, a URL spoof is
   // possible, so we must stop showing the pending entry.
-  RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
-      delegate_->GetRenderViewHost());
   bool safe_to_show_pending =
       pending_entry_ &&
       // Require a new navigation.
       pending_entry_->GetPageID() == -1 &&
       // Require either browser-initiated or an unmodified new tab.
-      (!pending_entry_->is_renderer_initiated() ||
-       (IsInitialNavigation() &&
-        !GetLastCommittedEntry() &&
-        !rvh->has_accessed_initial_document()));
+      (!pending_entry_->is_renderer_initiated() || IsUnmodifiedBlankTab());
 
   // Also allow showing the pending entry for history navigations in a new tab,
   // such as Ctrl+Back.  In this case, no existing page is visible and no one
   // can script the new tab before it commits.
   if (!safe_to_show_pending &&
       pending_entry_ &&
       pending_entry_->GetPageID() != -1 &&
       IsInitialNavigation() &&
       !pending_entry_->is_renderer_initiated())
     safe_to_show_pending = true;
@@ skipping 948 matching lines @@
 }
 
 void NavigationControllerImpl::SetMaxRestoredPageID(int32 max_id) {
   max_restored_page_id_ = max_id;
 }
 
 int32 NavigationControllerImpl::GetMaxRestoredPageID() const {
   return max_restored_page_id_;
 }
 
+bool NavigationControllerImpl::IsUnmodifiedBlankTab() const {
+  // TODO(creis): Move has_accessed_initial_document from RenderViewHost to
+  // WebContents and NavigationControllerDelegate.
+  RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
+      delegate_->GetRenderViewHost());
+  return IsInitialNavigation() &&
+      !GetLastCommittedEntry() &&
+      !rvh->has_accessed_initial_document();
+}
+
 SessionStorageNamespace*
 NavigationControllerImpl::GetSessionStorageNamespace(SiteInstance* instance) {
   std::string partition_id;
   if (instance) {
     // TODO(ajwong): When GetDefaultSessionStorageNamespace() goes away, remove
     // this if statement so |instance| must not be NULL.
     partition_id =
         GetContentClient()->browser()->GetStoragePartitionIdForSite(
             browser_context_, instance->GetSiteURL());
   }
@@ skipping 316 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content