Code: void ChromeWebContentsDelegateAndroid::AddNewContents(
    WebContents* source,
    WebContents* new_contents,
    WindowOpenDisposition disposition,
    const gfx::Rect& initial_rect,
    bool user_gesture,
    bool* was_blocked) {
  DCHECK_NE(disposition, SAVE_TO_DISK);
  DCHECK_NE(disposition, CURRENT_TAB);

  TabHelpers::AttachTabHelpers(new_contents);
 
   JNIEnv* env = AttachCurrentThread();
   ScopedJavaLocalRef<jobject> obj = GetJavaDelegate(env);
  AddWebContentsResult add_result =
      ADD_WEB_CONTENTS_RESULT_STOP_LOAD_AND_DELETE;
   if (!obj.is_null()) {
     ScopedJavaLocalRef<jobject> jsource;
     if (source)
      jsource = source->GetJavaWebContents();
    ScopedJavaLocalRef<jobject> jnew_contents;
     if (new_contents)
       jnew_contents = new_contents->GetJavaWebContents();
 
    add_result = static_cast<AddWebContentsResult>(
        Java_ChromeWebContentsDelegateAndroid_addNewContents(
            env,
            obj.obj(),
            jsource.obj(),
            jnew_contents.obj(),
            static_cast<jint>(disposition),
            NULL,
            user_gesture));
   }
 
   if (was_blocked)
    *was_blocked = !(add_result == ADD_WEB_CONTENTS_RESULT_PROCEED);
  if (add_result == ADD_WEB_CONTENTS_RESULT_STOP_LOAD_AND_DELETE)
     delete new_contents;
 }

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in the editing implementation in Blink, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that triggers removal of a node during processing of the DOM tree, related to CompositeEditCommand.cpp and ReplaceSelectionCommand.cpp.
Commit Message: Revert "Load web contents after tab is created."

This reverts commit 4c55f398def3214369aefa9f2f2e8f5940d3799d.

BUG=432562
TBR=tedchoc@chromium.org,jbudorick@chromium.org,sky@chromium.org

Review URL: https://codereview.chromium.org/894003005

Cr-Commit-Position: refs/heads/master@{#314469}