Don't treat http://gpu as a WebUI url

BUG=464922

Review URL: https://codereview.chromium.org/1129123004

Cr-Commit-Position: refs/heads/master@{#329285}
(cherry picked from commit 7cdcf50b4ae3858f5132a1bb0d4cb5e104527b42)
NOPRESUBMIT=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1130353007

Cr-Commit-Position: refs/branch-heads/2357@{#404}
Cr-Branched-From: 59d4494849b405682265ed5d3f5164573b9a939b-refs/heads/master@{#323860}

4 files changed, 37 insertions, 76 deletions

diff --git a/content/browser/site_instance_impl_unittest.cc b/content/browser/site_instance_impl_unittest.cc
index dd7c360..ff32c38 100644
--- a/content/browser/site_instance_impl_unittest.cc
+++ b/content/browser/site_instance_impl_unittest.cc
@@ -14,6 +14,7 @@
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/browser/webui/content_web_ui_controller_factory.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
@@ -34,35 +35,17 @@ namespace {
 
 const char kPrivilegedScheme[] = "privileged";
 
-class SiteInstanceTestWebUIControllerFactory : public WebUIControllerFactory {
- public:
-  WebUIController* CreateWebUIControllerForURL(WebUI* web_ui,
-                                               const GURL& url) const override {
-    return NULL;
-  }
-  WebUI::TypeID GetWebUIType(BrowserContext* browser_context,
-                             const GURL& url) const override {
-    return WebUI::kNoWebUI;
-  }
-  bool UseWebUIForURL(BrowserContext* browser_context,
-                      const GURL& url) const override {
-    return HasWebUIScheme(url);
-  }
-  bool UseWebUIBindingsForURL(BrowserContext* browser_context,
-                              const GURL& url) const override {
-    return HasWebUIScheme(url);
-  }
-};
-
 class SiteInstanceTestBrowserClient : public TestContentBrowserClient {
  public:
   SiteInstanceTestBrowserClient()
       : privileged_process_id_(-1) {
-    WebUIControllerFactory::RegisterFactory(&factory_);
+    WebUIControllerFactory::RegisterFactory(
+        ContentWebUIControllerFactory::GetInstance());
   }
 
   ~SiteInstanceTestBrowserClient() override {
-    WebUIControllerFactory::UnregisterFactoryForTesting(&factory_);
+    WebUIControllerFactory::UnregisterFactoryForTesting(
+        ContentWebUIControllerFactory::GetInstance());
   }
 
   bool IsSuitableHost(RenderProcessHost* process_host,
@@ -76,7 +59,6 @@ class SiteInstanceTestBrowserClient : public TestContentBrowserClient {
   }
 
  private:
-  SiteInstanceTestWebUIControllerFactory factory_;
   int privileged_process_id_;
 };
 
@@ -625,12 +607,12 @@ TEST_F(SiteInstanceTest, ProcessSharingByType) {
 
   // Create some WebUI instances and make sure they share a process.
   scoped_refptr<SiteInstanceImpl> webui1_instance(CreateSiteInstance(
-      browser_context.get(), GURL(kChromeUIScheme + std::string("://newtab"))));
+      browser_context.get(), GURL(kChromeUIScheme + std::string("://gpu"))));
   policy->GrantWebUIBindings(webui1_instance->GetProcess()->GetID());
 
-  scoped_refptr<SiteInstanceImpl> webui2_instance(
-      CreateSiteInstance(browser_context.get(),
-                         GURL(kChromeUIScheme + std::string("://history"))));
+  scoped_refptr<SiteInstanceImpl> webui2_instance(CreateSiteInstance(
+      browser_context.get(),
+      GURL(kChromeUIScheme + std::string("://media-internals"))));
 
   scoped_ptr<RenderProcessHost> dom_host(webui1_instance->GetProcess());
   EXPECT_EQ(webui1_instance->GetProcess(), webui2_instance->GetProcess());
@@ -677,10 +659,10 @@ TEST_F(SiteInstanceTest, HasWrongProcessForURL) {
   EXPECT_FALSE(instance->HasWrongProcessForURL(
       GURL("javascript:alert(document.location.href);")));
 
-  EXPECT_TRUE(instance->HasWrongProcessForURL(GURL("chrome://settings")));
+  EXPECT_TRUE(instance->HasWrongProcessForURL(GURL("chrome://gpu")));
 
   // Test that WebUI SiteInstances reject normal web URLs.
-  const GURL webui_url("chrome://settings");
+  const GURL webui_url("chrome://gpu");
   scoped_refptr<SiteInstanceImpl> webui_instance(static_cast<SiteInstanceImpl*>(
       SiteInstance::Create(browser_context.get())));
   webui_instance->SetSite(webui_url);
@@ -693,6 +675,7 @@ TEST_F(SiteInstanceTest, HasWrongProcessForURL) {
   EXPECT_TRUE(webui_instance->HasProcess());
   EXPECT_FALSE(webui_instance->HasWrongProcessForURL(webui_url));
   EXPECT_TRUE(webui_instance->HasWrongProcessForURL(GURL("http://google.com")));
+  EXPECT_TRUE(webui_instance->HasWrongProcessForURL(GURL("http://gpu")));
 
   // WebUI uses process-per-site, so another instance will use the same process
   // even if we haven't called GetProcess yet.  Make sure HasWrongProcessForURL
@@ -736,7 +719,7 @@ TEST_F(SiteInstanceTest, HasWrongProcessForURLInSitePerProcess) {
   EXPECT_FALSE(instance->HasWrongProcessForURL(
       GURL("javascript:alert(document.location.href);")));
 
-  EXPECT_TRUE(instance->HasWrongProcessForURL(GURL("chrome://settings")));
+  EXPECT_TRUE(instance->HasWrongProcessForURL(GURL("chrome://gpu")));
 
   DrainMessageLoops();
 }
@@ -755,7 +738,7 @@ TEST_F(SiteInstanceTest, ProcessPerSiteWithWrongBindings) {
 
   // Simulate navigating to a WebUI URL in a process that does not have WebUI
   // bindings.  This already requires bypassing security checks.
-  const GURL webui_url("chrome://settings");
+  const GURL webui_url("chrome://gpu");
   instance->SetSite(webui_url);
   EXPECT_TRUE(instance->HasSite());
 
diff --git a/content/browser/web_contents/web_contents_impl_unittest.cc b/content/browser/web_contents/web_contents_impl_unittest.cc
index 32f102d..34a761d 100644
--- a/content/browser/web_contents/web_contents_impl_unittest.cc
+++ b/content/browser/web_contents/web_contents_impl_unittest.cc
@@ -12,6 +12,7 @@
 #include "content/browser/media/audio_state_provider.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/site_instance_impl.h"
+#include "content/browser/webui/content_web_ui_controller_factory.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/common/frame_messages.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
@@ -42,39 +43,6 @@
 namespace content {
 namespace {
 
-const char kTestWebUIUrl[] = "chrome://blah";
-
-class WebContentsImplTestWebUIControllerFactory
-    : public WebUIControllerFactory {
- public:
-  WebUIController* CreateWebUIControllerForURL(WebUI* web_ui,
-                                               const GURL& url) const override {
-    if (!UseWebUI(url))
-      return nullptr;
-    return new WebUIController(web_ui);
-  }
-
-  WebUI::TypeID GetWebUIType(BrowserContext* browser_context,
-                             const GURL& url) const override {
-    return WebUI::kNoWebUI;
-  }
-
-  bool UseWebUIForURL(BrowserContext* browser_context,
-                      const GURL& url) const override {
-    return UseWebUI(url);
-  }
-
-  bool UseWebUIBindingsForURL(BrowserContext* browser_context,
-                              const GURL& url) const override {
-    return UseWebUI(url);
-  }
-
- private:
-  bool UseWebUI(const GURL& url) const {
-    return url == GURL(kTestWebUIUrl);
-  }
-};
-
 class TestInterstitialPage;
 
 class TestInterstitialPageDelegate : public InterstitialPageDelegate {
@@ -258,16 +226,15 @@ class WebContentsImplTest : public RenderViewHostImplTestHarness {
  public:
   void SetUp() override {
     RenderViewHostImplTestHarness::SetUp();
-    WebUIControllerFactory::RegisterFactory(&factory_);
+    WebUIControllerFactory::RegisterFactory(
+        ContentWebUIControllerFactory::GetInstance());
   }
 
   void TearDown() override {
-    WebUIControllerFactory::UnregisterFactoryForTesting(&factory_);
+    WebUIControllerFactory::UnregisterFactoryForTesting(
+        ContentWebUIControllerFactory::GetInstance());
     RenderViewHostImplTestHarness::TearDown();
   }
-
- private:
-  WebContentsImplTestWebUIControllerFactory factory_;
 };
 
 class TestWebContentsObserver : public WebContentsObserver {
@@ -1042,7 +1009,7 @@ TEST_F(WebContentsImplTest, CrossSiteNavigationPreempted) {
 
 TEST_F(WebContentsImplTest, CrossSiteNavigationBackPreempted) {
   // Start with a web ui page, which gets a new RVH with WebUI bindings.
-  const GURL url1("chrome://blah");
+  const GURL url1("chrome://gpu");
   controller().LoadURL(
       url1, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
   TestRenderFrameHost* ntp_rfh = contents()->GetMainFrame();
@@ -1181,8 +1148,8 @@ TEST_F(WebContentsImplTest, CrossSiteNavigationNotPreemptedByFrame) {
 // We should only preempt the cross-site navigation if the previous renderer
 // has started a new navigation.  See http://crbug.com/79176.
 TEST_F(WebContentsImplTest, CrossSiteNotPreemptedDuringBeforeUnload) {
-  // Navigate to NTP URL.
-  const GURL url("chrome://blah");
+  // Navigate to WebUI URL.
+  const GURL url("chrome://gpu");
   controller().LoadURL(
       url, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
   TestRenderFrameHost* orig_rfh = contents()->GetMainFrame();
@@ -1199,7 +1166,7 @@ TEST_F(WebContentsImplTest, CrossSiteNotPreemptedDuringBeforeUnload) {
   // Suppose the first navigation tries to commit now, with a
   // FrameMsg_Stop in flight.  This should not cancel the pending navigation,
   // but it should act as if the beforeunload ack arrived.
-  orig_rfh->SendNavigate(1, GURL("chrome://blah"));
+  orig_rfh->SendNavigate(1, GURL("chrome://gpu"));
   EXPECT_TRUE(contents()->cross_navigation_pending());
   EXPECT_EQ(orig_rfh, contents()->GetMainFrame());
   EXPECT_FALSE(orig_rfh->IsWaitingForBeforeUnloadACK());
@@ -2687,8 +2654,12 @@ TEST_F(WebContentsImplTest, ActiveContentsCountChangeBrowsingInstance) {
   contents->NavigateAndCommit(GURL("http://a.com"));
   EXPECT_EQ(1u, instance->GetRelatedActiveContentsCount());
 
+  // Navigate to a URL which sort of looks like a chrome:// url.
+  contents->NavigateAndCommit(GURL("http://gpu"));
+  EXPECT_EQ(1u, instance->GetRelatedActiveContentsCount());
+
   // Navigate to a URL with WebUI. This will change BrowsingInstances.
-  contents->GetController().LoadURL(GURL(kTestWebUIUrl),
+  contents->GetController().LoadURL(GURL("chrome://gpu"),
                                     Referrer(),
                                     ui::PAGE_TRANSITION_TYPED,
                                     std::string());
diff --git a/content/browser/webui/content_web_ui_controller_factory.cc b/content/browser/webui/content_web_ui_controller_factory.cc
index 7a92631..95dedcb 100644
--- a/content/browser/webui/content_web_ui_controller_factory.cc
+++ b/content/browser/webui/content_web_ui_controller_factory.cc
@@ -23,6 +23,9 @@ namespace content {
 
 WebUI::TypeID ContentWebUIControllerFactory::GetWebUIType(
       BrowserContext* browser_context, const GURL& url) const {
+  if (!url.SchemeIs(kChromeUIScheme))
+    return WebUI::kNoWebUI;
+
   if (url.host() == kChromeUIWebRTCInternalsHost ||
 #if !defined(OS_ANDROID)
       url.host() == kChromeUITracingHost ||
@@ -49,6 +52,9 @@ bool ContentWebUIControllerFactory::UseWebUIBindingsForURL(
 
 WebUIController* ContentWebUIControllerFactory::CreateWebUIControllerForURL(
     WebUI* web_ui, const GURL& url) const {
+  if (!url.SchemeIs(kChromeUIScheme))
+    return nullptr;
+
   if (url.host() == kChromeUIGpuHost)
     return new GpuInternalsUI(web_ui);
   if (url.host() == kChromeUIIndexedDBInternalsHost)
@@ -69,7 +75,7 @@ WebUIController* ContentWebUIControllerFactory::CreateWebUIControllerForURL(
     return new WebRTCInternalsUI(web_ui);
 #endif
 
-  return NULL;
+  return nullptr;
 }
 
 // static
diff --git a/content/browser/webui/content_web_ui_controller_factory.h b/content/browser/webui/content_web_ui_controller_factory.h
index f263811..d8e7a1c 100644
--- a/content/browser/webui/content_web_ui_controller_factory.h
+++ b/content/browser/webui/content_web_ui_controller_factory.h
@@ -12,7 +12,8 @@
 
 namespace content {
 
-class ContentWebUIControllerFactory : public WebUIControllerFactory {
+class CONTENT_EXPORT ContentWebUIControllerFactory
+    : public WebUIControllerFactory {
  public:
   WebUI::TypeID GetWebUIType(BrowserContext* browser_context,
                              const GURL& url) const override;