Fix popups from onunload handlers.

These popups should be checked against the page that created them and not the
page that we're currently navigating to.

BUG=40718
TEST=none

Review URL: http://codereview.chromium.org/1906007

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@46496 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 12 insertions, 3 deletions

diff --git a/chrome/browser/tab_contents/tab_contents.cc b/chrome/browser/tab_contents/tab_contents.cc
index 3eaf91a..2f3e743 100644
--- a/chrome/browser/tab_contents/tab_contents.cc
+++ b/chrome/browser/tab_contents/tab_contents.cc
@@ -1429,10 +1429,19 @@ void TabContents::SetIsLoading(bool is_loading,
 
 void TabContents::AddPopup(TabContents* new_contents,
                            const gfx::Rect& initial_pos) {
-  GURL url(GetURL());
-  if (url.is_valid() &&
+  // A page can't spawn popups (or do anything else, either) until its load
+  // commits, so when we reach here, the popup was spawned by the
+  // NavigationController's last committed entry, not the active entry.  For
+  // example, if a page opens a popup in an onunload() handler, then the active
+  // entry is the page to be loaded as we navigate away from the unloading
+  // page.  For this reason, we can't use GetURL() to get the opener URL,
+  // because it returns the active entry.
+  NavigationEntry* entry = controller_.GetLastCommittedEntry();
+  GURL creator = entry ? entry->virtual_url() : GURL::EmptyGURL();
+
+  if (creator.is_valid() &&
       profile()->GetHostContentSettingsMap()->GetContentSetting(
-          url, CONTENT_SETTINGS_TYPE_POPUPS) == CONTENT_SETTING_ALLOW) {
+          creator, CONTENT_SETTINGS_TYPE_POPUPS) == CONTENT_SETTING_ALLOW) {
     AddNewContents(new_contents, NEW_POPUP, initial_pos, true);
   } else {
     if (!blocked_popups_)