Allow showing pending URL for new tab navigations, but only if safe.

content/browser/renderer_host/render_view_host_impl.h

Index: content/browser/renderer_host/render_view_host_impl.h
diff --git a/content/browser/renderer_host/render_view_host_impl.h b/content/browser/renderer_host/render_view_host_impl.h
index 4b33cc01dc83f1fd0c1dd012f537852b4417e622..5a09697431b33a161977ee99d795690fac88161d 100644
--- a/content/browser/renderer_host/render_view_host_impl.h
+++ b/content/browser/renderer_host/render_view_host_impl.h
@@ -271,6 +271,13 @@ class CONTENT_EXPORT RenderViewHostImpl
   // Informs the renderer of when the current navigation was allowed to proceed.
   void SetNavigationStartTime(const base::TimeTicks& navigation_start);
 
+  // Whether the initial empty page of this view has been accessed by another
+  // page, making it unsafe to show the pending URL.  Always false after the
+  // first commit.
+  bool has_accessed_initial_document() {
+    return has_accessed_initial_document_;
+  }
+
   // Whether this RenderViewHost has been swapped out to be displayed by a
   // different process.
   bool is_swapped_out() const { return is_swapped_out_; }
@@ -556,6 +563,7 @@ class CONTENT_EXPORT RenderViewHostImpl
       const ShowDesktopNotificationHostMsgParams& params);
   void OnCancelDesktopNotification(int notification_id);
   void OnRunFileChooser(const FileChooserParams& params);
+  void OnDidAccessInitialDocument();
   void OnDomOperationResponse(const std::string& json_string,
                               int automation_id);
   void OnFrameTreeUpdated(const std::string& frame_tree);
@@ -609,6 +617,12 @@ class CONTENT_EXPORT RenderViewHostImpl
   // second navigation occurs.
   scoped_ptr<ViewMsg_Navigate> suspended_nav_message_;
 
+  // Whether the initial empty page of this view has been accessed by another
+  // page, making it unsafe to show the pending URL.  Usually false unless
+  // another window tries to modify the blank page.  Always false after the
+  // first commit.
+  bool has_accessed_initial_document_;
+
   // Whether this RenderViewHost is currently swapped out, such that the view is
   // being rendered by another process.
   bool is_swapped_out_;