6 files changed, 94 insertions, 11 deletions
diff --git a/chrome/browser/ssl/ssl_browser_tests.cc b/chrome/browser/ssl/ssl_browser_tests.cc
index 92d054c..e95d456 100644
--- a/chrome/browser/ssl/ssl_browser_tests.cc
+++ b/chrome/browser/ssl/ssl_browser_tests.cc
@@ -176,6 +176,43 @@ IN_PROC_BROWSER_TEST_F(SSLUITest, TestHTTPSExpiredCertAndDontProceed) {
   CheckUnauthenticatedState(tab);
 }
 
+// Open a page with a HTTPS error in a tab with no prior navigation (through a
+// link with a blank target).  This is to test that the lack of navigation entry
+// does not cause any problems (it was causing a crasher, see
+// http://crbug.com/19941).
+IN_PROC_BROWSER_TEST_F(SSLUITest, TestHTTPSErrorWithNoNavEntry) {
+  scoped_refptr<HTTPTestServer> http_server = PlainServer();
+  scoped_refptr<HTTPSTestServer> bad_https_server = BadCertServer();
+
+  // Load a page with a link that opens a new window (therefore with no history
+  // and no navigation entries).
+  ui_test_utils::NavigateToURL(browser(), http_server->TestServerPageW(
+      L"files/ssl/page_with_blank_target.html"));
+
+  bool success = false;
+  // Simulate clicking the link (and therefore navigating to that new page).
+  // This will causes a new tab to be created.
+  EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool(
+      browser()->GetSelectedTabContents()->render_view_host(), L"",
+      L"window.domAutomationController.send(navigateInNewTab());",
+      &success));
+  EXPECT_TRUE(success);
+
+  // By the time we got a response, the new tab should have been created and be
+  // the selected tab.
+  EXPECT_EQ(2, browser()->tab_count());
+  EXPECT_EQ(1, browser()->selected_index());
+
+  // Since the navigation was initiated by the renderer (when we clicked on the
+  // link) and since the main page network request failed, we won't get a
+  // navigation entry committed.  So we'll just wait for the load to stop.
+  ui_test_utils::WaitForLoadStop(
+      &(browser()->GetSelectedTabContents()->controller()));
+
+  // We should have an interstitial page showing.
+  ASSERT_TRUE(browser()->GetSelectedTabContents()->interstitial_page());
+}
+
 //
 // Mixed contents
 //
diff --git a/chrome/browser/tab_contents/tab_contents.cc b/chrome/browser/tab_contents/tab_contents.cc
index 261d547..0e8471d 100644
--- a/chrome/browser/tab_contents/tab_contents.cc
+++ b/chrome/browser/tab_contents/tab_contents.cc
@@ -832,6 +832,10 @@ void TabContents::AddNewContents(TabContents* new_contents,
     new_contents->DisassociateFromPopupCount();
     delegate_->AddNewContents(this, new_contents, disposition, initial_pos,
                               user_gesture);
+    NotificationService::current()->Notify(
+        NotificationType::TAB_ADDED,
+        Source<TabContentsDelegate>(delegate_),
+        Details<TabContents>(this));
   }
   PopupNotificationVisibilityChanged(ShowingBlockedPopupNotification());
 }
diff --git a/chrome/common/notification_type.h b/chrome/common/notification_type.h
index 1e445a6..9f30770 100644
--- a/chrome/common/notification_type.h
+++ b/chrome/common/notification_type.h
@@ -231,6 +231,10 @@ class NotificationType {
 
     // Tabs --------------------------------------------------------------------
 
+    // Sent when a tab is added to a TabContentsDelegate. The source is the
+    // TabContentsDelegate and the details is the TabContents.
+    TAB_ADDED,
+
     // This notification is sent after a tab has been appended to the
     // tab_strip.  The source is a Source<NavigationController> with a pointer
     // to controller for the added tab. There are no details.
diff --git a/chrome/test/data/ssl/page_with_blank_target.html b/chrome/test/data/ssl/page_with_blank_target.html
new file mode 100644
index 0000000..46df5a2
--- /dev/null
+++ b/chrome/test/data/ssl/page_with_blank_target.html
@@ -0,0 +1,24 @@
+<html>
+
+ <head><title>This is a simple test page</title>
+ <script>
+  function simulateClick(target) {
+    var evt = document.createEvent("MouseEvents");
+    evt.initMouseEvent("click", true, true, window,
+                       0, 0, 0, 0, 0, false, false,
+                       false, false, 0, null);
+
+    return target.dispatchEvent(evt);
+  }
+
+  function navigateInNewTab() {
+    return simulateClick(document.getElementById("bad_link"));
+  }
+
+ </script>
+ </head>
+
+<a href="https://127.0.0.1:9666/files/ssl/google.html" id="bad_link" target="_blank">This is a bad link</a>
+
+</html>
+
diff --git a/chrome/test/ui_test_utils.cc b/chrome/test/ui_test_utils.cc
index 543828b..e92f260 100644
--- a/chrome/test/ui_test_utils.cc
+++ b/chrome/test/ui_test_utils.cc
@@ -230,28 +230,25 @@ class AppModalDialogObserver : public NotificationObserver {
   DISALLOW_COPY_AND_ASSIGN(AppModalDialogObserver);
 };
 
-class CrashedRenderProcessObserver : public NotificationObserver {
+template <class T>
+class SimpleNotificationObserver : public NotificationObserver {
  public:
-  explicit CrashedRenderProcessObserver(RenderProcessHost* rph) {
-    registrar_.Add(this, NotificationType::RENDERER_PROCESS_CLOSED,
-                   Source<RenderProcessHost>(rph));
+  SimpleNotificationObserver(NotificationType notification_type,
+                             T* source) {
+    registrar_.Add(this, notification_type, Source<T>(source));
     ui_test_utils::RunMessageLoop();
   }
 
   virtual void Observe(NotificationType type,
                        const NotificationSource& source,
                        const NotificationDetails& details) {
-    if (type == NotificationType::RENDERER_PROCESS_CLOSED) {
-      MessageLoopForUI::current()->Quit();
-    } else {
-      NOTREACHED();
-    }
+    MessageLoopForUI::current()->Quit();
   }
 
  private:
   NotificationRegistrar registrar_;
 
-  DISALLOW_COPY_AND_ASSIGN(CrashedRenderProcessObserver);
+  DISALLOW_COPY_AND_ASSIGN(SimpleNotificationObserver);
 };
 
 }  // namespace
@@ -308,6 +305,16 @@ void WaitForNavigations(NavigationController* controller,
   NavigationNotificationObserver observer(controller, number_of_navigations);
 }
 
+void WaitForNewTab(Browser* browser) {
+  SimpleNotificationObserver<Browser>
+      new_tab_observer(NotificationType::TAB_ADDED, browser);
+}
+
+void WaitForLoadStop(NavigationController* controller) {
+  SimpleNotificationObserver<NavigationController>
+      new_tab_observer(NotificationType::LOAD_STOP, controller);
+}
+
 void NavigateToURL(Browser* browser, const GURL& url) {
   NavigateToURLBlockUntilNavigationsComplete(browser, url, 1);
 }
@@ -408,7 +415,8 @@ AppModalDialog* WaitForAppModalDialog() {
 void CrashTab(TabContents* tab) {
   RenderProcessHost* rph = tab->render_view_host()->process();
   base::KillProcess(rph->process().handle(), 0, false);
-  CrashedRenderProcessObserver crash_observer(rph);
+  SimpleNotificationObserver<RenderProcessHost>
+      crash_observer(NotificationType::RENDERER_PROCESS_CLOSED, rph);
 }
 
 }  // namespace ui_test_utils
diff --git a/chrome/test/ui_test_utils.h b/chrome/test/ui_test_utils.h
index 94e4235..b623027 100644
--- a/chrome/test/ui_test_utils.h
+++ b/chrome/test/ui_test_utils.h
@@ -49,6 +49,12 @@ void WaitForNavigation(NavigationController* controller);
 void WaitForNavigations(NavigationController* controller,
                         int number_of_navigations);
 
+// Waits for a new tab to be added to |browser|.
+void WaitForNewTab(Browser* browser);
+
+// Waits for a load stop for the specified |controller|.
+void WaitForLoadStop(NavigationController* controller);
+
 // Navigates the selected tab of |browser| to |url|, blocking until the
 // navigation finishes.
 void NavigateToURL(Browser* browser, const GURL& url);