Allow "cross-origin" navigations from about:blank in AreURLsInPageNavigation

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index a751ccd3da09dd5b6223138a65e5fe20776e9635..d698686ac32db942cb33366f931051773afbbacd 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -123,6 +123,13 @@ bool AreURLsInPageNavigation(const GURL& existing_url,
                              RenderFrameHost* rfh) {
   WebPreferences prefs = rfh->GetRenderViewHost()->GetWebkitPreferences();
   bool is_same_origin = existing_url.is_empty() ||
+                        // TODO(japhet): We should only permit navigations
+                        // originating from about:blank to be in-page if the
+                        // about:blank is the first document that frame loaded.
+                        // We don't have sufficient information to identify
+                        // that case at the moment, so always allow about:blank
+                        // for now.
+                        existing_url == GURL(url::kAboutBlankURL) ||
                         existing_url.GetOrigin() == new_url.GetOrigin() ||
                         !prefs.web_security_enabled;
   if (!is_same_origin && renderer_says_in_page)