Allow showing pending URL for new tab navigations, but only if safe.

content/renderer/render_view_impl.cc

Index: content/renderer/render_view_impl.cc
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index b78531b24dcc3d46317e6e1fb898677aa5908944..cf5c8a1b5b338ec62777c7ab0739cc80276db2c2 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -2774,6 +2774,13 @@ WebCookieJar* RenderViewImpl::cookieJar(WebFrame* frame) {
   return &cookie_jar_;
 }
 
+void RenderViewImpl::didAccessInitialDocument(WebFrame* frame) {
+  // Notify the browser process that it is no longer safe to show the pending
+  // URL of the main frame, since a URL spoof is now possible.
+  if (!frame->parent() && page_id_ == -1)
+    Send(new ViewHostMsg_DidAccessInitialDocument(routing_id_));
+}
+
 void RenderViewImpl::didCreateFrame(WebFrame* parent, WebFrame* child) {
   if (!updating_frame_tree_)
     SendUpdatedFrameTree(NULL);