Convert session history ui test to a browser test, renabling all the disabled tests and got rid of flaky patterns. Hopefully they don't fail again.

BUG=121574
Review URL: https://chromiumcodereview.appspot.com/10144015

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@133458 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 485 insertions, 568 deletions

diff --git a/chrome/browser/history/history_browsertest.cc b/chrome/browser/history/history_browsertest.cc
index a9f7d35..c636af7 100644
--- a/chrome/browser/history/history_browsertest.cc
+++ b/chrome/browser/history/history_browsertest.cc
@@ -13,9 +13,11 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/common/chrome_switches.h"
+#include "chrome/common/url_constants.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "content/public/browser/web_contents.h"
 #include "content/test/test_browser_thread.h"
 #include "googleurl/src/gurl.h"
 
@@ -284,3 +286,19 @@ IN_PROC_BROWSER_TEST_F(HistoryBrowserTest,
   // Therefore, Page 21 should be in the history in addition to Page 22.
   LoadAndWaitForFile("history_length_test_page_21.html");
 }
+
+// If this test flakes, use bug 22111.
+IN_PROC_BROWSER_TEST_F(HistoryBrowserTest, HistorySearchXSS) {
+  GURL url(std::string(chrome::kChromeUIHistoryURL) +
+      "#q=%3Cimg%20src%3Dx%3Ax%20onerror%3D%22document.title%3D'XSS'%22%3E");
+  ui_test_utils::NavigateToURL(browser(), url);
+  // Mainly, this is to ensure we send a synchronous message to the renderer
+  // so that we're not susceptible (less susceptible?) to a race condition.
+  // Should a race condition ever trigger, it won't result in flakiness.
+  int num = ui_test_utils::FindInPage(
+      browser()->GetSelectedTabContentsWrapper(), ASCIIToUTF16("<img"), true,
+      true, NULL);
+  EXPECT_GT(num, 0);
+  EXPECT_EQ(ASCIIToUTF16("History"),
+            browser()->GetSelectedWebContents()->GetTitle());
+}
diff --git a/chrome/browser/session_history_uitest.cc b/chrome/browser/session_history_uitest.cc
deleted file mode 100644
index 57a251a..0000000
--- a/chrome/browser/session_history_uitest.cc
+++ /dev/null
@@ -1,567 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/string_util.h"
-#include "chrome/common/url_constants.h"
-#include "chrome/test/automation/automation_proxy.h"
-#include "chrome/test/automation/browser_proxy.h"
-#include "chrome/test/automation/tab_proxy.h"
-#include "chrome/test/ui/ui_test.h"
-#include "grit/generated_resources.h"
-#include "net/base/net_util.h"
-#include "net/test/test_server.h"
-
-namespace {
-
-class SessionHistoryTest : public UITest {
- protected:
-  SessionHistoryTest()
-      : test_server_(net::TestServer::TYPE_HTTP,
-                     net::TestServer::kLocalhost,
-                     FilePath(FILE_PATH_LITERAL("chrome/test/data"))) {
-    dom_automation_enabled_ = true;
-  }
-
-  virtual void SetUp() {
-    UITest::SetUp();
-
-    window_ = automation()->GetBrowserWindow(0);
-    ASSERT_TRUE(window_.get());
-
-    tab_ = window_->GetActiveTab();
-    ASSERT_TRUE(tab_.get());
-  }
-
-  // Simulate clicking a link.  Only works on the frames.html testserver page.
-  void ClickLink(std::string node_id) {
-    GURL url("javascript:clickLink('" + node_id + "')");
-    ASSERT_TRUE(tab_->NavigateToURL(url));
-  }
-
-  // Simulate filling in form data.  Only works on the frames.html page with
-  // subframe = form.html, and on form.html itself.
-  void FillForm(std::string node_id, std::string value) {
-    GURL url("javascript:fillForm('" + node_id + "', '" + value + "')");
-    // This will return immediately, but since the JS executes synchronously
-    // on the renderer, it will complete before the next navigate message is
-    // processed.
-    ASSERT_TRUE(tab_->NavigateToURLAsync(url));
-  }
-
-  // Simulate submitting a form.  Only works on the frames.html page with
-  // subframe = form.html, and on form.html itself.
-  void SubmitForm(std::string node_id) {
-    GURL url("javascript:submitForm('" + node_id + "')");
-    ASSERT_TRUE(tab_->NavigateToURL(url));
-  }
-
-  // Navigate session history using history.go(distance).
-  void JavascriptGo(std::string distance) {
-    GURL url("javascript:history.go('" + distance + "')");
-    ASSERT_TRUE(tab_->NavigateToURL(url));
-  }
-
-  std::wstring GetTabTitle() {
-    std::wstring title;
-    EXPECT_TRUE(tab_->GetTabTitle(&title));
-    return title;
-  }
-
-  GURL GetTabURL() {
-    GURL url;
-    EXPECT_TRUE(tab_->GetCurrentURL(&url));
-    return url;
-  }
-
- protected:
-  scoped_refptr<BrowserProxy> window_;
-  scoped_refptr<TabProxy> tab_;
-
-  net::TestServer test_server_;
-};
-
-#if defined(OS_WIN) || defined(OS_MACOSX)
-// See http://crbug.com/61619 on windows.
-// See http://crbug.com/102094 on mac.
-#define MAYBE_BasicBackForward DISABLED_BasicBackForward
-#else
-#define MAYBE_BasicBackForward BasicBackForward
-#endif
-
-TEST_F(SessionHistoryTest, MAYBE_BasicBackForward) {
-  ASSERT_TRUE(test_server_.Start());
-
-  // about:blank should be loaded first.
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  ASSERT_TRUE(tab_->NavigateToURL(
-      test_server_.GetURL("files/session_history/bot1.html")));
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  ASSERT_TRUE(tab_->NavigateToURL(
-      test_server_.GetURL("files/session_history/bot2.html")));
-  EXPECT_EQ(L"bot2", GetTabTitle());
-
-  ASSERT_TRUE(tab_->NavigateToURL(
-      test_server_.GetURL("files/session_history/bot3.html")));
-  EXPECT_EQ(L"bot3", GetTabTitle());
-
-  // history is [blank, bot1, bot2, *bot3]
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"bot2", GetTabTitle());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  ASSERT_TRUE(tab_->GoForward());
-  EXPECT_EQ(L"bot2", GetTabTitle());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  ASSERT_TRUE(tab_->NavigateToURL(
-      test_server_.GetURL("files/session_history/bot3.html")));
-  EXPECT_EQ(L"bot3", GetTabTitle());
-
-  // history is [blank, bot1, *bot3]
-
-  ASSERT_FALSE(tab_->GoForward());
-  EXPECT_EQ(L"bot3", GetTabTitle());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  ASSERT_TRUE(tab_->GoForward());
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  ASSERT_TRUE(tab_->GoForward());
-  EXPECT_EQ(L"bot3", GetTabTitle());
-}
-
-// Test that back/forward works when navigating in subframes.
-#if defined(OS_WIN)
-// http://crbug.com/48833
-#define FrameBackForward DISABLED_FrameBackForward
-#endif
-TEST_F(SessionHistoryTest, FrameBackForward) {
-  ASSERT_TRUE(test_server_.Start());
-
-  // about:blank should be loaded first.
-  GURL home(homepage());
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-  EXPECT_EQ(home, GetTabURL());
-
-  GURL frames(test_server_.GetURL("files/session_history/frames.html"));
-  ASSERT_TRUE(tab_->NavigateToURL(frames));
-  EXPECT_EQ(L"bot1", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ClickLink("abot2");
-  EXPECT_EQ(L"bot2", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ClickLink("abot3");
-  EXPECT_EQ(L"bot3", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  // history is [blank, bot1, bot2, *bot3]
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"bot2", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"bot1", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-  EXPECT_EQ(home, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoForward());
-  EXPECT_EQ(L"bot1", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoForward());
-  EXPECT_EQ(L"bot2", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ClickLink("abot1");
-  EXPECT_EQ(L"bot1", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  // history is [blank, bot1, bot2, *bot1]
-
-  ASSERT_FALSE(tab_->GoForward());
-  EXPECT_EQ(L"bot1", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"bot2", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"bot1", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-}
-
-// See http://crbug.com/61619
-// Test that back/forward preserves POST data and document state in subframes.
-TEST_F(SessionHistoryTest, DISABLED_FrameFormBackForward) {
-  ASSERT_TRUE(test_server_.Start());
-
-  // about:blank should be loaded first.
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"", GetTabTitle());
-
-  GURL frames(test_server_.GetURL("files/session_history/frames.html"));
-  ASSERT_TRUE(tab_->NavigateToURL(frames));
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  ClickLink("aform");
-  EXPECT_EQ(L"form", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  SubmitForm("isubmit");
-  EXPECT_EQ(L"text=&select=a", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"form", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  // history is [blank, bot1, *form, post]
-
-  ClickLink("abot2");
-  EXPECT_EQ(L"bot2", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  // history is [blank, bot1, form, *bot2]
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"form", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  SubmitForm("isubmit");
-  EXPECT_EQ(L"text=&select=a", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  // history is [blank, bot1, form, *post]
-
-  if (false) {
-    // TODO(mpcomplete): reenable this when WebKit bug 10199 is fixed:
-    // "returning to a POST result within a frame does a GET instead of a POST"
-    ClickLink("abot2");
-    EXPECT_EQ(L"bot2", GetTabTitle());
-    EXPECT_EQ(frames, GetTabURL());
-
-    ASSERT_TRUE(tab_->GoBack());
-    EXPECT_EQ(L"text=&select=a", GetTabTitle());
-    EXPECT_EQ(frames, GetTabURL());
-  }
-}
-
-// TODO(mpcomplete): enable this when Bug 734372 is fixed:
-// "Doing a session history navigation does not restore newly-created subframe
-// document state"
-// Test that back/forward preserves POST data and document state when navigating
-// across frames (ie, from frame -> nonframe).
-// Hangs, see http://crbug.com/45058.
-TEST_F(SessionHistoryTest, DISABLED_CrossFrameFormBackForward) {
-  ASSERT_TRUE(test_server_.Start());
-
-  // about:blank should be loaded first.
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"", GetTabTitle());
-
-  GURL frames(test_server_.GetURL("files/session_history/frames.html"));
-  ASSERT_TRUE(tab_->NavigateToURL(frames));
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  ClickLink("aform");
-  EXPECT_EQ(L"form", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  SubmitForm("isubmit");
-  EXPECT_EQ(L"text=&select=a", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"form", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  // history is [blank, bot1, *form, post]
-
-  // ClickLink(L"abot2");
-  GURL bot2("files/session_history/bot2.html");
-  ASSERT_TRUE(tab_->NavigateToURL(bot2));
-  EXPECT_EQ(L"bot2", GetTabTitle());
-  EXPECT_EQ(bot2, GetTabURL());
-
-  // history is [blank, bot1, form, *bot2]
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"form", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-
-  SubmitForm("isubmit");
-  EXPECT_EQ(L"text=&select=a", GetTabTitle());
-  EXPECT_EQ(frames, GetTabURL());
-}
-
-
-#if defined(OS_WIN)
-// See http://crbug.com/61619
-#define MAYBE_FragmentBackForward DISABLED_FragmentBackForward
-#else
-#define MAYBE_FragmentBackForward FragmentBackForward
-#endif
-
-// Test that back/forward entries are created for reference fragment
-// navigations. Bug 730379.
-TEST_F(SessionHistoryTest, MAYBE_FragmentBackForward) {
-  ASSERT_TRUE(test_server_.Start());
-
-  // about:blank should be loaded first.
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  GURL fragment(test_server_.GetURL("files/session_history/fragment.html"));
-  ASSERT_TRUE(tab_->NavigateToURL(fragment));
-  EXPECT_EQ(L"fragment", GetTabTitle());
-  EXPECT_EQ(fragment, GetTabURL());
-
-  GURL::Replacements ref_params;
-
-  ref_params.SetRef("a", url_parse::Component(0, 1));
-  GURL fragment_a(fragment.ReplaceComponents(ref_params));
-  ASSERT_TRUE(tab_->NavigateToURL(fragment_a));
-  EXPECT_EQ(L"fragment", GetTabTitle());
-  EXPECT_EQ(fragment_a, GetTabURL());
-
-  ref_params.SetRef("b", url_parse::Component(0, 1));
-  GURL fragment_b(fragment.ReplaceComponents(ref_params));
-  ASSERT_TRUE(tab_->NavigateToURL(fragment_b));
-  EXPECT_EQ(L"fragment", GetTabTitle());
-  EXPECT_EQ(fragment_b, GetTabURL());
-
-  ref_params.SetRef("c", url_parse::Component(0, 1));
-  GURL fragment_c(fragment.ReplaceComponents(ref_params));
-  ASSERT_TRUE(tab_->NavigateToURL(fragment_c));
-  EXPECT_EQ(L"fragment", GetTabTitle());
-  EXPECT_EQ(fragment_c, GetTabURL());
-
-  // history is [blank, fragment, fragment#a, fragment#b, *fragment#c]
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(fragment_b, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(fragment_a, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(fragment, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoForward());
-  EXPECT_EQ(fragment_a, GetTabURL());
-
-  GURL bot3(test_server_.GetURL("files/session_history/bot3.html"));
-  ASSERT_TRUE(tab_->NavigateToURL(bot3));
-  EXPECT_EQ(L"bot3", GetTabTitle());
-  EXPECT_EQ(bot3, GetTabURL());
-
-  // history is [blank, fragment, fragment#a, bot3]
-
-  ASSERT_FALSE(tab_->GoForward());
-  EXPECT_EQ(bot3, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(fragment_a, GetTabURL());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(fragment, GetTabURL());
-}
-
-// Test that the javascript window.history object works.
-// NOTE: history.go(N) does not do anything if N is outside the bounds of the
-// back/forward list (such as trigger our start/stop loading events).  This
-// means the test will hang if it attempts to navigate too far forward or back,
-// since we'll be waiting forever for a load stop event.
-//
-// TODO(brettw) bug 50648: fix flakyness. This test seems like it was failing
-// about 1/4 of the time on Vista by failing to execute JavascriptGo (see bug).
-TEST_F(SessionHistoryTest, DISABLED_JavascriptHistory) {
-  ASSERT_TRUE(test_server_.Start());
-
-  // about:blank should be loaded first.
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  ASSERT_TRUE(tab_->NavigateToURL(
-      test_server_.GetURL("files/session_history/bot1.html")));
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  ASSERT_TRUE(tab_->NavigateToURL(
-      test_server_.GetURL("files/session_history/bot2.html")));
-  EXPECT_EQ(L"bot2", GetTabTitle());
-
-  ASSERT_TRUE(tab_->NavigateToURL(
-      test_server_.GetURL("files/session_history/bot3.html")));
-  EXPECT_EQ(L"bot3", GetTabTitle());
-
-  // history is [blank, bot1, bot2, *bot3]
-
-  JavascriptGo("-1");
-  EXPECT_EQ(L"bot2", GetTabTitle());
-
-  JavascriptGo("-1");
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  JavascriptGo("1");
-  EXPECT_EQ(L"bot2", GetTabTitle());
-
-  JavascriptGo("-1");
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  JavascriptGo("2");
-  EXPECT_EQ(L"bot3", GetTabTitle());
-
-  // history is [blank, bot1, bot2, *bot3]
-
-  JavascriptGo("-3");
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  JavascriptGo("1");
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  ASSERT_TRUE(tab_->NavigateToURL(
-      test_server_.GetURL("files/session_history/bot3.html")));
-  EXPECT_EQ(L"bot3", GetTabTitle());
-
-  // history is [blank, bot1, *bot3]
-
-  ASSERT_FALSE(tab_->GoForward());
-  EXPECT_EQ(L"bot3", GetTabTitle());
-
-  JavascriptGo("-1");
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  JavascriptGo("-1");
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  JavascriptGo("1");
-  EXPECT_EQ(L"bot1", GetTabTitle());
-
-  JavascriptGo("1");
-  EXPECT_EQ(L"bot3", GetTabTitle());
-
-  // TODO(creis): Test that JavaScript history navigations work across tab
-  // types.  For example, load about:network in a tab, then a real page, then
-  // try to go back and forward with JavaScript.  Bug 1136715.
-  // (Hard to test right now, because pages like about:network cause the
-  // TabProxy to hang.  This is because they do not appear to use the
-  // NotificationService.)
-}
-
-// This test is failing consistently. See http://crbug.com/22560
-TEST_F(SessionHistoryTest, FAILS_LocationReplace) {
-  ASSERT_TRUE(test_server_.Start());
-
-  // Test that using location.replace doesn't leave the title of the old page
-  // visible.
-  ASSERT_TRUE(tab_->NavigateToURL(test_server_.GetURL(
-      "files/session_history/replace.html?no-title.html")));
-  EXPECT_EQ(L"", GetTabTitle());
-}
-
-// This test is flaky. See bug 22111.
-TEST_F(SessionHistoryTest, DISABLED_HistorySearchXSS) {
-  // about:blank should be loaded first.
-  ASSERT_FALSE(tab_->GoBack());
-  EXPECT_EQ(L"about:blank", GetTabTitle());
-
-  GURL url(std::string(chrome::kChromeUIHistoryURL) +
-      "#q=%3Cimg%20src%3Dx%3Ax%20onerror%3D%22document.title%3D'XSS'%22%3E");
-  ASSERT_TRUE(tab_->NavigateToURL(url));
-  // Mainly, this is to ensure we send a synchronous message to the renderer
-  // so that we're not susceptible (less susceptible?) to a race condition.
-  // Should a race condition ever trigger, it won't result in flakiness.
-  int num = tab_->FindInPage(L"<img", FWD, CASE_SENSITIVE, false, NULL);
-  EXPECT_GT(num, 0);
-  EXPECT_EQ(L"History", GetTabTitle());
-}
-
-#if defined(OS_WIN)
-// See http://crbug.com/61619
-#define MAYBE_LocationChangeInSubframe DISABLED_LocationChangeInSubframe
-#else
-#define MAYBE_LocationChangeInSubframe LocationChangeInSubframe
-#endif
-
-TEST_F(SessionHistoryTest, MAYBE_LocationChangeInSubframe) {
-  ASSERT_TRUE(test_server_.Start());
-
-  ASSERT_TRUE(tab_->NavigateToURL(test_server_.GetURL(
-      "files/session_history/location_redirect.html")));
-  EXPECT_EQ(L"Default Title", GetTabTitle());
-
-  ASSERT_TRUE(tab_->NavigateToURL(GURL(
-      "javascript:void(frames[0].navigate())")));
-  EXPECT_EQ(L"foo", GetTabTitle());
-
-  ASSERT_TRUE(tab_->GoBack());
-  EXPECT_EQ(L"Default Title", GetTabTitle());
-}
-
-// http://code.google.com/p/chromium/issues/detail?id=56267
-TEST_F(SessionHistoryTest, DISABLED_HistoryLength) {
-  ASSERT_TRUE(test_server_.Start());
-
-  int length;
-  ASSERT_TRUE(tab_->ExecuteAndExtractInt(
-      L"", L"domAutomationController.send(history.length)", &length));
-  EXPECT_EQ(1, length);
-
-  ASSERT_TRUE(tab_->NavigateToURL(test_server_.GetURL("files/title1.html")));
-
-  ASSERT_TRUE(tab_->ExecuteAndExtractInt(
-      L"", L"domAutomationController.send(history.length)", &length));
-  EXPECT_EQ(2, length);
-
-  // Now test that history.length is updated when the navigation is committed.
-  ASSERT_TRUE(tab_->NavigateToURL(test_server_.GetURL(
-      "files/session_history/record_length.html")));
-  ASSERT_TRUE(tab_->ExecuteAndExtractInt(
-      L"", L"domAutomationController.send(history.length)", &length));
-  EXPECT_EQ(3, length);
-  ASSERT_TRUE(tab_->ExecuteAndExtractInt(
-      L"", L"domAutomationController.send(history_length)", &length));
-  EXPECT_EQ(3, length);
-
-  ASSERT_TRUE(tab_->GoBack());
-  ASSERT_TRUE(tab_->GoBack());
-
-  // Ensure history.length is properly truncated.
-  ASSERT_TRUE(tab_->NavigateToURL(test_server_.GetURL("files/title2.html")));
-  ASSERT_TRUE(tab_->ExecuteAndExtractInt(
-      L"", L"domAutomationController.send(history.length)", &length));
-  EXPECT_EQ(2, length);
-}
-
-}  // namespace
diff --git a/chrome/chrome_tests.gypi b/chrome/chrome_tests.gypi
index a2f1710..e29caf3 100644
--- a/chrome/chrome_tests.gypi
+++ b/chrome/chrome_tests.gypi
@@ -715,7 +715,6 @@
         # New tests should be browser_tests. browser_tests are sharded and are
         # less flakier.
         'browser/process_singleton_linux_uitest.cc',
-        'browser/session_history_uitest.cc',
         'browser/sessions/session_restore_uitest.cc',
         'browser/ui/tests/browser_uitest.cc',
         'browser/ui/views/find_bar_host_uitest.cc',
@@ -3050,6 +3049,7 @@
         '../content/browser/renderer_host/render_view_host_browsertest.cc',
         '../content/browser/renderer_host/render_view_host_manager_browsertest.cc',
         '../content/browser/renderer_host/resource_dispatcher_host_browsertest.cc',
+        '../content/browser/session_history_browsertest.cc',
         '../content/browser/speech/speech_recognition_browsertest.cc',
         '../content/browser/webkit_browsertest.cc',
         '../content/browser/worker_host/test/worker_browsertest.cc',
diff --git a/content/browser/session_history_browsertest.cc b/content/browser/session_history_browsertest.cc
new file mode 100644
index 0000000..74d94e3
--- /dev/null
+++ b/content/browser/session_history_browsertest.cc
@@ -0,0 +1,466 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/string_util.h"
+#include "base/utf_string_conversions.h"
+#include "chrome/browser/ui/browser.h"
+#include "chrome/test/base/in_process_browser_test.h"
+#include "chrome/test/base/ui_test_utils.h"
+#include "content/public/browser/notification_service.h"
+#include "content/public/browser/notification_types.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/common/url_constants.h"
+#include "net/test/test_server.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+class SessionHistoryTest : public InProcessBrowserTest {
+ protected:
+  SessionHistoryTest() {
+    EnableDOMAutomation();
+  }
+
+  virtual void SetUpOnMainThread() {
+    ASSERT_TRUE(test_server()->Start());
+  }
+
+  // Simulate clicking a link.  Only works on the frames.html testserver page.
+  void ClickLink(std::string node_id) {
+    GURL url("javascript:clickLink('" + node_id + "')");
+    ui_test_utils::NavigateToURL(browser(), url);
+  }
+
+  // Simulate filling in form data.  Only works on the frames.html page with
+  // subframe = form.html, and on form.html itself.
+  void FillForm(std::string node_id, std::string value) {
+    GURL url("javascript:fillForm('" + node_id + "', '" + value + "')");
+    // This will return immediately, but since the JS executes synchronously
+    // on the renderer, it will complete before the next navigate message is
+    // processed.
+    ui_test_utils::NavigateToURLWithDisposition(browser(), url, CURRENT_TAB, 0);
+  }
+
+  // Simulate submitting a form.  Only works on the frames.html page with
+  // subframe = form.html, and on form.html itself.
+  void SubmitForm(std::string node_id) {
+    GURL url("javascript:submitForm('" + node_id + "')");
+    ui_test_utils::NavigateToURL(browser(), url);
+  }
+
+  // Navigate session history using history.go(distance).
+  void JavascriptGo(std::string distance) {
+    GURL url("javascript:history.go('" + distance + "')");
+    ui_test_utils::NavigateToURL(browser(), url);
+  }
+
+  std::string GetTabTitle() {
+    return UTF16ToASCII(browser()->GetSelectedWebContents()->GetTitle());
+  }
+
+  GURL GetTabURL() {
+    return browser()->GetSelectedWebContents()->GetURL();
+  }
+
+  GURL GetURL(const std::string file) {
+    return test_server()->GetURL(std::string("files/session_history/") + file);
+  }
+
+  void NavigateAndCheckTitle(const char* filename,
+                             const std::string& expected_title) {
+    string16 expected_title16(ASCIIToUTF16(expected_title));
+    ui_test_utils::TitleWatcher title_watcher(
+        browser()->GetSelectedWebContents(), expected_title16);
+    ui_test_utils::NavigateToURL(browser(), GetURL(filename));
+    ASSERT_EQ(expected_title16, title_watcher.WaitAndGetTitle());
+  }
+
+  void GoBack() {
+    ui_test_utils::WindowedNotificationObserver load_stop_observer(
+      content::NOTIFICATION_LOAD_STOP,
+      content::NotificationService::AllSources());
+    browser()->GoBack(CURRENT_TAB);
+    load_stop_observer.Wait();
+  }
+
+  void GoForward() {
+    ui_test_utils::WindowedNotificationObserver load_stop_observer(
+      content::NOTIFICATION_LOAD_STOP,
+      content::NotificationService::AllSources());
+    browser()->GoForward(CURRENT_TAB);
+    load_stop_observer.Wait();
+  }
+};
+
+// If this flakes, use http://crbug.com/61619 on windows and
+// http://crbug.com/102094 on mac.
+IN_PROC_BROWSER_TEST_F(SessionHistoryTest, BasicBackForward) {
+  // about:blank should be loaded first.
+  ASSERT_FALSE(browser()->CanGoBack());
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot1.html", "bot1"));
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot2.html", "bot2"));
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot3.html", "bot3"));
+
+  // history is [blank, bot1, bot2, *bot3]
+
+  GoBack();
+  EXPECT_EQ("bot2", GetTabTitle());
+
+  GoBack();
+  EXPECT_EQ("bot1", GetTabTitle());
+
+  GoForward();
+  EXPECT_EQ("bot2", GetTabTitle());
+
+  GoBack();
+  EXPECT_EQ("bot1", GetTabTitle());
+
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot3.html", "bot3"));
+
+  // history is [blank, bot1, *bot3]
+
+  ASSERT_FALSE(browser()->CanGoForward());
+  EXPECT_EQ("bot3", GetTabTitle());
+
+  GoBack();
+  EXPECT_EQ("bot1", GetTabTitle());
+
+  GoBack();
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  ASSERT_FALSE(browser()->CanGoBack());
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  GoForward();
+  EXPECT_EQ("bot1", GetTabTitle());
+
+  GoForward();
+  EXPECT_EQ("bot3", GetTabTitle());
+}
+
+// Test that back/forward works when navigating in subframes.
+// If this flakes, use http://crbug.com/48833
+IN_PROC_BROWSER_TEST_F(SessionHistoryTest, FrameBackForward) {
+  // about:blank should be loaded first.
+  GURL home(chrome::kAboutBlankURL);
+  ASSERT_FALSE(browser()->CanGoBack());
+  EXPECT_EQ("about:blank", GetTabTitle());
+  EXPECT_EQ(GURL(chrome::kAboutBlankURL), GetTabURL());
+
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("frames.html", "bot1"));
+
+  ClickLink("abot2");
+  EXPECT_EQ("bot2", GetTabTitle());
+  GURL frames(GetURL("frames.html"));
+  EXPECT_EQ(frames, GetTabURL());
+
+  ClickLink("abot3");
+  EXPECT_EQ("bot3", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  // history is [blank, bot1, bot2, *bot3]
+
+  GoBack();
+  EXPECT_EQ("bot2", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  GoBack();
+  EXPECT_EQ("bot1", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  GoBack();
+  EXPECT_EQ("about:blank", GetTabTitle());
+  EXPECT_EQ(home, GetTabURL());
+
+  GoForward();
+  EXPECT_EQ("bot1", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  GoForward();
+  EXPECT_EQ("bot2", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  ClickLink("abot1");
+  EXPECT_EQ("bot1", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  // history is [blank, bot1, bot2, *bot1]
+
+  ASSERT_FALSE(browser()->CanGoForward());
+  EXPECT_EQ("bot1", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  GoBack();
+  EXPECT_EQ("bot2", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  GoBack();
+  EXPECT_EQ("bot1", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+}
+
+// Test that back/forward preserves POST data and document state in subframes.
+// If this flakes use http://crbug.com/61619
+IN_PROC_BROWSER_TEST_F(SessionHistoryTest, FrameFormBackForward) {
+  // about:blank should be loaded first.
+  ASSERT_FALSE(browser()->CanGoBack());
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("frames.html", "bot1"));
+
+  ClickLink("aform");
+  EXPECT_EQ("form", GetTabTitle());
+  GURL frames(GetURL("frames.html"));
+  EXPECT_EQ(frames, GetTabURL());
+
+  SubmitForm("isubmit");
+  EXPECT_EQ("text=&select=a", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  GoBack();
+  EXPECT_EQ("form", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  // history is [blank, bot1, *form, post]
+
+  ClickLink("abot2");
+  EXPECT_EQ("bot2", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  // history is [blank, bot1, form, *bot2]
+
+  GoBack();
+  EXPECT_EQ("form", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  SubmitForm("isubmit");
+  EXPECT_EQ("text=&select=a", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  // history is [blank, bot1, form, *post]
+
+  // TODO(mpcomplete): reenable this when WebKit bug 10199 is fixed:
+  // "returning to a POST result within a frame does a GET instead of a POST"
+  ClickLink("abot2");
+  EXPECT_EQ("bot2", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  GoBack();
+  EXPECT_EQ("text=&select=a", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+}
+
+// TODO(mpcomplete): enable this when Bug 734372 is fixed:
+// "Doing a session history navigation does not restore newly-created subframe
+// document state"
+// Test that back/forward preserves POST data and document state when navigating
+// across frames (ie, from frame -> nonframe).
+// Hangs, see http://crbug.com/45058.
+IN_PROC_BROWSER_TEST_F(SessionHistoryTest, CrossFrameFormBackForward) {
+  // about:blank should be loaded first.
+  ASSERT_FALSE(browser()->CanGoBack());
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  GURL frames(GetURL("frames.html"));
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("frames.html", "bot1"));
+
+  ClickLink("aform");
+  EXPECT_EQ("form", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  SubmitForm("isubmit");
+  EXPECT_EQ("text=&select=a", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  GoBack();
+  EXPECT_EQ("form", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  // history is [blank, bot1, *form, post]
+
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot2.html", "bot2"));
+
+  // history is [blank, bot1, form, *bot2]
+
+  GoBack();
+  EXPECT_EQ("bot1", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+
+  SubmitForm("isubmit");
+  EXPECT_EQ("text=&select=a", GetTabTitle());
+  EXPECT_EQ(frames, GetTabURL());
+}
+
+// Test that back/forward entries are created for reference fragment
+// navigations. Bug 730379.
+// If this flakes use http://crbug.com/61619.
+IN_PROC_BROWSER_TEST_F(SessionHistoryTest, FragmentBackForward) {
+  // about:blank should be loaded first.
+  ASSERT_FALSE(browser()->CanGoBack());
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  GURL fragment(GetURL("fragment.html"));
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("fragment.html", "fragment"));
+
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("fragment.html#a", "fragment"));
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("fragment.html#b", "fragment"));
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("fragment.html#c", "fragment"));
+
+  // history is [blank, fragment, fragment#a, fragment#b, *fragment#c]
+
+  GoBack();
+  EXPECT_EQ(GetURL("fragment.html#b"), GetTabURL());
+
+  GoBack();
+  EXPECT_EQ(GetURL("fragment.html#a"), GetTabURL());
+
+  GoBack();
+  EXPECT_EQ(GetURL("fragment.html"), GetTabURL());
+
+  GoForward();
+  EXPECT_EQ(GetURL("fragment.html#a"), GetTabURL());
+
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot3.html", "bot3"));
+
+  // history is [blank, fragment, fragment#a, bot3]
+
+  ASSERT_FALSE(browser()->CanGoForward());
+  EXPECT_EQ(GetURL("bot3.html"), GetTabURL());
+
+  GoBack();
+  EXPECT_EQ(GetURL("fragment.html#a"), GetTabURL());
+
+  GoBack();
+  EXPECT_EQ(GetURL("fragment.html"), GetTabURL());
+}
+
+// Test that the javascript window.history object works.
+// NOTE: history.go(N) does not do anything if N is outside the bounds of the
+// back/forward list (such as trigger our start/stop loading events).  This
+// means the test will hang if it attempts to navigate too far forward or back,
+// since we'll be waiting forever for a load stop event.
+//
+// TODO(brettw) bug 50648: fix flakyness. This test seems like it was failing
+// about 1/4 of the time on Vista by failing to execute JavascriptGo (see bug).
+IN_PROC_BROWSER_TEST_F(SessionHistoryTest, JavascriptHistory) {
+  // about:blank should be loaded first.
+  ASSERT_FALSE(browser()->CanGoBack());
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot1.html", "bot1"));
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot2.html", "bot2"));
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot3.html", "bot3"));
+
+  // history is [blank, bot1, bot2, *bot3]
+
+  JavascriptGo("-1");
+  EXPECT_EQ("bot2", GetTabTitle());
+
+  JavascriptGo("-1");
+  EXPECT_EQ("bot1", GetTabTitle());
+
+  JavascriptGo("1");
+  EXPECT_EQ("bot2", GetTabTitle());
+
+  JavascriptGo("-1");
+  EXPECT_EQ("bot1", GetTabTitle());
+
+  JavascriptGo("2");
+  EXPECT_EQ("bot3", GetTabTitle());
+
+  // history is [blank, bot1, bot2, *bot3]
+
+  JavascriptGo("-3");
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  ASSERT_FALSE(browser()->CanGoBack());
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  JavascriptGo("1");
+  EXPECT_EQ("bot1", GetTabTitle());
+
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle("bot3.html", "bot3"));
+
+  // history is [blank, bot1, *bot3]
+
+  ASSERT_FALSE(browser()->CanGoForward());
+  EXPECT_EQ("bot3", GetTabTitle());
+
+  JavascriptGo("-1");
+  EXPECT_EQ("bot1", GetTabTitle());
+
+  JavascriptGo("-1");
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  ASSERT_FALSE(browser()->CanGoBack());
+  EXPECT_EQ("about:blank", GetTabTitle());
+
+  JavascriptGo("1");
+  EXPECT_EQ("bot1", GetTabTitle());
+
+  JavascriptGo("1");
+  EXPECT_EQ("bot3", GetTabTitle());
+
+  // TODO(creis): Test that JavaScript history navigations work across tab
+  // types.  For example, load about:network in a tab, then a real page, then
+  // try to go back and forward with JavaScript.  Bug 1136715.
+  // (Hard to test right now, because pages like about:network cause the
+  // TabProxy to hang.  This is because they do not appear to use the
+  // NotificationService.)
+}
+
+// This test is failing consistently. See http://crbug.com/22560
+IN_PROC_BROWSER_TEST_F(SessionHistoryTest, LocationReplace) {
+  // Test that using location.replace doesn't leave the title of the old page
+  // visible.
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle(
+      "replace.html?bot1.html", "bot1"));
+}
+
+IN_PROC_BROWSER_TEST_F(SessionHistoryTest, LocationChangeInSubframe) {
+  ASSERT_NO_FATAL_FAILURE(NavigateAndCheckTitle(
+      "location_redirect.html", "Default Title"));
+
+  ui_test_utils::NavigateToURL(
+      browser(), GURL("javascript:void(frames[0].navigate())"));
+  EXPECT_EQ("foo", GetTabTitle());
+
+  GoBack();
+  EXPECT_EQ("Default Title", GetTabTitle());
+}
+
+// http://code.google.com/p/chromium/issues/detail?id=56267
+IN_PROC_BROWSER_TEST_F(SessionHistoryTest, HistoryLength) {
+  int length;
+  ASSERT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractInt(
+      browser()->GetSelectedWebContents()->GetRenderViewHost(),
+      L"", L"domAutomationController.send(history.length)", &length));
+  EXPECT_EQ(1, length);
+
+  ui_test_utils::NavigateToURL(browser(), GetURL("title1.html"));
+
+  ASSERT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractInt(
+      browser()->GetSelectedWebContents()->GetRenderViewHost(),
+      L"", L"domAutomationController.send(history.length)", &length));
+  EXPECT_EQ(2, length);
+
+  // Now test that history.length is updated when the navigation is committed.
+  ui_test_utils::NavigateToURL(browser(), GetURL("record_length.html"));
+
+  ASSERT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractInt(
+      browser()->GetSelectedWebContents()->GetRenderViewHost(),
+      L"", L"domAutomationController.send(history.length)", &length));
+  EXPECT_EQ(3, length);
+
+  GoBack();
+  GoBack();
+
+  // Ensure history.length is properly truncated.
+  ui_test_utils::NavigateToURL(browser(), GetURL("title2.html"));
+
+  ASSERT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractInt(
+      browser()->GetSelectedWebContents()->GetRenderViewHost(),
+      L"", L"domAutomationController.send(history.length)", &length));
+  EXPECT_EQ(2, length);
+}