Allow "cross-origin" navigations from about:blank in AreURLsInPageNavigation

content/browser/frame_host/navigation_controller_impl_unittest.cc

Index: content/browser/frame_host/navigation_controller_impl_unittest.cc
diff --git a/content/browser/frame_host/navigation_controller_impl_unittest.cc b/content/browser/frame_host/navigation_controller_impl_unittest.cc
index ab4d7c5c116ad693753620e787d35c53b9214e67..c5bc95acb3a02f1e6143ade6f3e4cd5efaa0a925 100644
--- a/content/browser/frame_host/navigation_controller_impl_unittest.cc
+++ b/content/browser/frame_host/navigation_controller_impl_unittest.cc
@@ -3115,6 +3115,15 @@ TEST_F(NavigationControllerTest, IsInPageNavigation) {
   EXPECT_TRUE(controller.IsURLInPageNavigation(other_url, true,
       main_test_rfh()));
 
+  // If the renderer navigates from about:blank, believe it. This can happen
+  // when an iframe is created and populated via document.write(), then tries
+  // to perform a fragment navigation.
+  const GURL blank_url(url::kAboutBlankURL);
+  main_test_rfh()->SendNavigate(0, blank_url);
+  EXPECT_TRUE(controller.IsURLInPageNavigation(other_url, true,
+      main_test_rfh()));
+  main_test_rfh()->SendNavigate(0, url);
+
   // Don't believe the renderer if it claims a cross-origin navigation is
   // in-page.
   const GURL different_origin_url("http://www.example.com");