Support Android username-only credentials.

components/password_manager/core/browser/affiliated_match_helper.cc

Index: components/password_manager/core/browser/affiliated_match_helper.cc
diff --git a/components/password_manager/core/browser/affiliated_match_helper.cc b/components/password_manager/core/browser/affiliated_match_helper.cc
index f01cc04d5c10f7ab82daba50bc39e0d5a5e4eb9a..8e3fc4e0db56111e6eca67b00c0ff0cc98ddbe92 100644
--- a/components/password_manager/core/browser/affiliated_match_helper.cc
+++ b/components/password_manager/core/browser/affiliated_match_helper.cc
@@ -138,13 +138,21 @@ ScopedVector<autofill::PasswordForm>
 AffiliatedMatchHelper::TransformAffiliatedAndroidCredentials(
     const autofill::PasswordForm& observed_form,
     ScopedVector<autofill::PasswordForm> android_credentials) {
-  for (autofill::PasswordForm* form : android_credentials) {
-    DCHECK_EQ(form->scheme, autofill::PasswordForm::SCHEME_HTML);
+  ScopedVector<autofill::PasswordForm> result;
+  for (auto& form : android_credentials) {

[Mike West, 2015/09/29 09:36:09]

Nit: Why change this to `auto`? It seemed clearer before.

[vabr (Chromium), 2015/10/09 07:53:09]

Vasilii now needs a reference to that pointer to be able to null it in the end.
So it would have to be something like autofill::PasswordForm*& if that's a valid
syntax at all. To capture that this is a reference, "auto&" is better, because
the & in the end is easier to spot. But I'm indifferent on which way this ends
up being written, so will let mkwst and vasilii figure out what's best. :)

[vasilii, 2015/10/12 15:12:48]

Acknowledged.

+    if (form->scheme == autofill::PasswordForm::SCHEME_USERNAME_ONLY) {
+      if (form->federation_url.is_empty())

[Mike West, 2015/09/29 09:36:09]

I don't really understand this. Why do we have federated username only
credentials? Why don't we ignore them?

[engedy, 2015/10/08 17:31:01]

Note that I have recently landed a fix for https://crbug.com/539833 which
disables returning federated logins as affiliated matches from
PasswordStore::GetLogins(). However, that does not affect the Credential Manager
API, as a different code path is used by the API.

If we want to include them here or in the Manage Passwords bubble, that will
need to be changed.

[vasilii, 2015/10/12 15:12:48]

We can ignore them but they still exist on the machine. Given that they may be
valuable for the user why not to show them in the account chooser (without
zero-click of course)?

+        continue;
+      else
+        form->skip_zero_click = true;
+    }
     form->origin = observed_form.origin;
     form->original_signon_realm = form->signon_realm;
     form->signon_realm = observed_form.signon_realm;
+    result.push_back(form);
+    form = nullptr;
   }
-  return android_credentials.Pass();
+  return result.Pass();
 }
 
 void AffiliatedMatchHelper::SetTaskRunnerUsedForWaitingForTesting(