Don't leave aborted URLs in the omnibox unless we're on a new tab.

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index af191921609cae8e96c2c6321c7037dacd75be94..715c8957778de58a6c1d7eb09a65f04a687f93d8 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -429,17 +429,12 @@ NavigationEntry* NavigationControllerImpl::GetVisibleEntry() const {
   // long as no other page has tried to access the initial empty document in
   // the new tab.  If another page modifies this blank page, a URL spoof is
   // possible, so we must stop showing the pending entry.
-  RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
-      delegate_->GetRenderViewHost());
   bool safe_to_show_pending =
       pending_entry_ &&
       // Require a new navigation.
       pending_entry_->GetPageID() == -1 &&
       // Require either browser-initiated or an unmodified new tab.
-      (!pending_entry_->is_renderer_initiated() ||
-       (IsInitialNavigation() &&
-        !GetLastCommittedEntry() &&
-        !rvh->has_accessed_initial_document()));
+      (!pending_entry_->is_renderer_initiated() || IsUnmodifiedBlankTab());
 
   // Also allow showing the pending entry for history navigations in a new tab,
   // such as Ctrl+Back.  In this case, no existing page is visible and no one
@@ -1408,6 +1403,16 @@ int32 NavigationControllerImpl::GetMaxRestoredPageID() const {
   return max_restored_page_id_;
 }
 
+bool NavigationControllerImpl::IsUnmodifiedBlankTab() const {
+  // TODO(creis): Move has_accessed_initial_document from RenderViewHost to
+  // WebContents and NavigationControllerDelegate.
+  RenderViewHostImpl* rvh = static_cast<RenderViewHostImpl*>(
+      delegate_->GetRenderViewHost());
+  return IsInitialNavigation() &&
+      !GetLastCommittedEntry() &&
+      !rvh->has_accessed_initial_document();
+}
+
 SessionStorageNamespace*
 NavigationControllerImpl::GetSessionStorageNamespace(SiteInstance* instance) {
   std::string partition_id;