Mark HistorySearchXSS as flaky.

chrome/browser/session_history_uitest.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "app/l10n_util.h"
 #include "base/file_path.h"
 #include "base/platform_thread.h"
 #include "base/string_util.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/test/automation/tab_proxy.h"
@@ skipping 479 matching lines @@
   // visible.
   scoped_refptr<HTTPTestServer> server =
       HTTPTestServer::CreateServer(kDocRoot, NULL);
   ASSERT_TRUE(NULL != server.get());
 
   ASSERT_TRUE(tab_->NavigateToURL(server->TestServerPage(
       "files/session_history/replace.html?no-title.html")));
   EXPECT_EQ(L"", GetTabTitle());
 }
 
-TEST_F(SessionHistoryTest, HistorySearchXSS) {
+// This test is flaky. See bug 22111.
+TEST_F(SessionHistoryTest, FLAKY_HistorySearchXSS) {
   // about:blank should be loaded first.
   ASSERT_FALSE(tab_->GoBack());
   EXPECT_EQ(L"", GetTabTitle());
 
   GURL url(std::string(chrome::kChromeUIHistoryURL) +
       "#q=%3Cimg%20src%3Dx%3Ax%20onerror%3D%22document.title%3D'XSS'%22%3E");
   ASSERT_TRUE(tab_->NavigateToURL(url));
   // Mainly, this is to ensure we send a synchronous message to the renderer
   // so that we're not susceptible (less susceptible?) to a race condition.
   // Should a race condition ever trigger, it won't result in flakiness.
@@ skipping 13 matching lines @@
 
   ASSERT_TRUE(tab_->NavigateToURL(GURL(
       "javascript:void(frames[0].navigate())")));
   EXPECT_EQ(L"foo", GetTabTitle());
 
   ASSERT_TRUE(tab_->GoBack());
   EXPECT_EQ(L"Default Title", GetTabTitle());
 }
 
 }  // namespace