7 files changed, 77 insertions, 0 deletions
diff --git a/chrome/browser/prerender/prerender_browsertest.cc b/chrome/browser/prerender/prerender_browsertest.cc
index 35b3bff..c9c46912c 100644
--- a/chrome/browser/prerender/prerender_browsertest.cc
+++ b/chrome/browser/prerender/prerender_browsertest.cc
@@ -1687,6 +1687,26 @@ IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest,
   NavigateToURL("files/prerender/prerender_page.html");
 }
 
+// Checks that redirects with location.replace do not cancel a prerender and
+// and swap when navigating to the first page.
+IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest,
+                       PrerenderLocationReplaceNavigateToFirst) {
+  PrerenderTestURL("files/prerender/prerender_location_replace.html",
+                   FINAL_STATUS_USED,
+                   2);
+  NavigateToDestURL();
+}
+
+// Checks that redirects with location.replace do not cancel a prerender and
+// and swap when navigating to the second.
+IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest,
+                       PrerenderLocationReplaceNavigateToSecond) {
+  PrerenderTestURL("files/prerender/prerender_location_replace.html",
+                   FINAL_STATUS_USED,
+                   2);
+  NavigateToURL("files/prerender/prerender_page.html");
+}
+
 // Checks that client-issued redirects work with prerendering.
 // This version navigates to the final destination page, rather than the
 // page which does the redirection via a mouse click.
@@ -3285,4 +3305,12 @@ IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest,
   NavigateToURLWithParams(params, false);
 }
 
+// Checks that the prerendering of a page is canceled correctly when the
+// prerendered page tries to make a second navigation entry.
+IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest, PrerenderNewNavigationEntry) {
+  PrerenderTestURL("files/prerender/prerender_new_entry.html",
+                   FINAL_STATUS_NEW_NAVIGATION_ENTRY,
+                   1);
+}
+
 }  // namespace prerender
diff --git a/chrome/browser/prerender/prerender_contents.cc b/chrome/browser/prerender/prerender_contents.cc
index 9eb11de..6781ecf 100644
--- a/chrome/browser/prerender/prerender_contents.cc
+++ b/chrome/browser/prerender/prerender_contents.cc
@@ -586,6 +586,19 @@ void PrerenderContents::DidFinishLoad(int64 frame_id,
 void PrerenderContents::DidNavigateMainFrame(
     const content::LoadCommittedDetails& details,
     const content::FrameNavigateParams& params) {
+  // If the prerender made a second navigation entry, abort the prerender. This
+  // avoids having to correctly implement a complex history merging case (this
+  // interacts with location.replace) and correctly synchronize with the
+  // renderer. The final status may be monitored to see we need to revisit this
+  // decision. This does not affect client redirects as those do not push new
+  // history entries. (Calls to location.replace, navigations before onload, and
+  // <meta http-equiv=refresh> with timeouts under 1 second do not create
+  // entries in Blink.)
+  if (prerender_contents_->GetController().GetEntryCount() > 1) {
+    Destroy(FINAL_STATUS_NEW_NAVIGATION_ENTRY);
+    return;
+  }
+
   // Add each redirect as an alias. |params.url| is included in
   // |params.redirects|.
   //
diff --git a/chrome/browser/prerender/prerender_final_status.cc b/chrome/browser/prerender/prerender_final_status.cc
index c84a4ae..ac0526d 100644
--- a/chrome/browser/prerender/prerender_final_status.cc
+++ b/chrome/browser/prerender/prerender_final_status.cc
@@ -58,6 +58,7 @@ const char* kFinalStatusNames[] = {
   "Page Being Captured",
   "Bad Deferred Redirect",
   "Navigation Uncommitted",
+  "New Navigation Entry",
   "Max",
 };
 COMPILE_ASSERT(arraysize(kFinalStatusNames) == FINAL_STATUS_MAX + 1,
diff --git a/chrome/browser/prerender/prerender_final_status.h b/chrome/browser/prerender/prerender_final_status.h
index 1d702d5..41ab465 100644
--- a/chrome/browser/prerender/prerender_final_status.h
+++ b/chrome/browser/prerender/prerender_final_status.h
@@ -59,6 +59,7 @@ enum FinalStatus {
   FINAL_STATUS_PAGE_BEING_CAPTURED = 44,
   FINAL_STATUS_BAD_DEFERRED_REDIRECT = 45,
   FINAL_STATUS_NAVIGATION_UNCOMMITTED = 46,
+  FINAL_STATUS_NEW_NAVIGATION_ENTRY = 47,
   FINAL_STATUS_MAX,
 };
 
diff --git a/chrome/test/data/prerender/prerender_location_replace.html b/chrome/test/data/prerender/prerender_location_replace.html
new file mode 100644
index 0000000..1d7adf8
--- /dev/null
+++ b/chrome/test/data/prerender/prerender_location_replace.html
@@ -0,0 +1,16 @@
+<html>
+  <!--
+  This test navigates to prerender_page.html via location.replace.
+  -->
+  <head>
+    <title>Prerender location.replace after load</title>
+    <script>
+      window.onload = function() {
+        setTimeout(function() {
+          location.replace("prerender_page.html");
+        });
+      };
+    </script>
+  </head>
+  <body></body>
+</html>
diff --git a/chrome/test/data/prerender/prerender_new_entry.html b/chrome/test/data/prerender/prerender_new_entry.html
new file mode 100644
index 0000000..1a20122
--- /dev/null
+++ b/chrome/test/data/prerender/prerender_new_entry.html
@@ -0,0 +1,17 @@
+<html>
+  <!--
+  This test navigates to prerender_page.html after the onload event to create a
+  new navigation entry.
+  -->
+  <head>
+    <title>Prerender navigate after load</title>
+    <script>
+      window.onload = function() {
+        setTimeout(function() {
+          location.href = "prerender_page.html";
+        });
+      };
+    </script>
+  </head>
+  <body></body>
+</html>
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 27aaee8..03b4508 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -27331,6 +27331,7 @@ other types of suffix sets.
   <int value="44" label="PAGE_BEING_CAPTURED"/>
   <int value="45" label="BAD_DEFERRED_REDIRECT"/>
   <int value="46" label="NAVIGATION_UNCOMMITTED"/>
+  <int value="47" label="NEW_NAVIGATION_ENTRY"/>
 </enum>
 
 <enum name="PrerenderHoverEvent" type="int">