4 files changed, 25 insertions, 16 deletions
diff --git a/chrome/browser/external_tab_container_win.cc b/chrome/browser/external_tab_container_win.cc
index 94aec46..4e22b3e 100644
--- a/chrome/browser/external_tab_container_win.cc
+++ b/chrome/browser/external_tab_container_win.cc
@@ -37,7 +37,10 @@
 
 static const wchar_t kWindowObjectKey[] = L"ChromeWindowObject";
 
-ExternalTabContainer::PendingTabs ExternalTabContainer::pending_tabs_;
+base::LazyInstance<ExternalTabContainer::PendingTabs>
+    ExternalTabContainer::pending_tabs_(base::LINKER_INITIALIZED);
+
+// ExternalTabContainer::PendingTabs ExternalTabContainer::pending_tabs_;
 ExternalTabContainer* ExternalTabContainer::innermost_tab_for_unload_event_
     = NULL;
 
@@ -347,7 +350,7 @@ void ExternalTabContainer::AddNewContents(TabContents* source,
 
   if (result) {
     uintptr_t cookie = reinterpret_cast<uintptr_t>(new_container.get());
-    pending_tabs_[cookie] = new_container;
+    pending_tabs_.Get()[cookie] = new_container;
     new_container->set_pending(true);
     IPC::AttachExternalTabParams attach_params_;
     attach_params_.cookie = static_cast<uint64>(cookie);
@@ -764,10 +767,11 @@ bool ExternalTabContainer::InitNavigationInfo(IPC::NavigationInfo* nav_info,
 
 scoped_refptr<ExternalTabContainer> ExternalTabContainer::RemovePendingTab(
     uintptr_t cookie) {
-  PendingTabs::iterator index = pending_tabs_.find(cookie);
-  if (index != pending_tabs_.end()) {
+  ExternalTabContainer::PendingTabs& pending_tabs = pending_tabs_.Get();
+  PendingTabs::iterator index = pending_tabs.find(cookie);
+  if (index != pending_tabs.end()) {
     scoped_refptr<ExternalTabContainer> container = (*index).second;
-    pending_tabs_.erase(index);
+    pending_tabs.erase(index);
     return container;
   }
 
diff --git a/chrome/browser/external_tab_container_win.h b/chrome/browser/external_tab_container_win.h
index 133be98..6306749 100644
--- a/chrome/browser/external_tab_container_win.h
+++ b/chrome/browser/external_tab_container_win.h
@@ -7,7 +7,7 @@
 
 #include <vector>
 #include <map>
-
+#include "base/lazy_instance.h"
 #include "chrome/browser/automation/automation_resource_message_filter.h"
 #include "chrome/browser/automation/automation_profile_impl.h"
 #include "chrome/browser/browser.h"
@@ -292,7 +292,7 @@ class ExternalTabContainer : public TabContentsDelegate,
   scoped_ptr<Browser> browser_;
 
   // Contains ExternalTabContainers that have not been connected to as yet.
-  static PendingTabs pending_tabs_;
+  static base::LazyInstance<PendingTabs> pending_tabs_;
 
   // True if this tab is currently the conduit for extension API automation.
   bool enabled_extension_automation_;
diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 693746f..5d5079f 100755
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -5172,6 +5172,19 @@ bool RenderView::IsNonLocalTopLevelNavigation(
       return true;
     }
   }
+  // Not interested in reloads.
+  if (type != WebKit::WebNavigationTypeReload &&
+      type != WebKit::WebNavigationTypeFormSubmitted) {
+    // The opener relationship between the new window and the parent allows the
+    // new window to script the parent and vice versa. This is not allowed if
+    // the origins of the two domains are different. This can be treated as a
+    // top level navigation and routed back to the host.
+    WebKit::WebFrame* opener = frame->opener();
+    if (opener) {
+      if (url.GetOrigin() != GURL(opener->url()).GetOrigin())
+        return true;
+    }
+  }
   return false;
 }
 
diff --git a/chrome/test/automation/automation_proxy_uitest.cc b/chrome/test/automation/automation_proxy_uitest.cc
index cf037ed..1629147 100644
--- a/chrome/test/automation/automation_proxy_uitest.cc
+++ b/chrome/test/automation/automation_proxy_uitest.cc
@@ -1281,10 +1281,6 @@ TEST_F(ExternalTabUITestPopupEnabled, UserGestureTargetBlank) {
       "<a href='http://foo.com/' target='_blank'>Link</a>";
   mock_->ServeHTMLData(1, main_url, main_html);
 
-  GURL foo_url("http://foo.com/");
-  std::string foo_html = "<!DOCTYPE html>Foo lives here";
-  mock_->ServeHTMLData(2, foo_url, foo_html);
-
   HWND foo_host = CreateWindowW(L"Button", L"foo_host",
       WS_OVERLAPPEDWINDOW | WS_CLIPCHILDREN, CW_USEDEFAULT, CW_USEDEFAULT,
       CW_USEDEFAULT,  CW_USEDEFAULT, NULL, NULL, NULL, NULL);
@@ -1296,15 +1292,11 @@ TEST_F(ExternalTabUITestPopupEnabled, UserGestureTargetBlank) {
 
   EXPECT_CALL(*mock_, OnAttachExternalTab(1, _))
       .Times(1)
-      .WillOnce(testing::WithArgs<1>(testing::Invoke(CreateFunctor(mock_,
-          &ExternalTabUITestMockClient::ConnectToExternalTab, foo_host))));
-
-  EXPECT_CALL(*mock_, OnLoad(2, _)).WillOnce(QUIT_LOOP_SOON(&loop, 500));
+      .WillOnce(QUIT_LOOP_SOON(&loop, 500));
 
   mock_->CreateTabWithUrl(main_url);
   loop.RunFor(action_max_timeout_ms());
 
-  EXPECT_CALL(*mock_, HandleClosed(2));
   EXPECT_CALL(*mock_, HandleClosed(1));
   ::DestroyWindow(foo_host);
   mock_->DestroyHostWindow();