Load cookies once per 'document.cookie' read

content/browser/frame_host/render_frame_message_filter_browsertest.cc

Index: content/browser/frame_host/render_frame_message_filter_browsertest.cc
diff --git a/content/browser/frame_host/render_frame_message_filter_browsertest.cc b/content/browser/frame_host/render_frame_message_filter_browsertest.cc
index 3362e96081c27f68e53255ac69a4314bb5a76828..7312fca4442d273300847c85104d5d68749d77f3 100644
--- a/content/browser/frame_host/render_frame_message_filter_browsertest.cc
+++ b/content/browser/frame_host/render_frame_message_filter_browsertest.cc
@@ -53,7 +53,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, Cookies) {
 
   // The server sends a HttpOnly cookie. The RenderFrameMessageFilter should
   // never allow this to be sent to any renderer process.
-  GURL https_url = https_server.GetURL("/set-cookie?notforjs=1;HttpOnly");
+  GURL https_url = https_server.GetURL("/set_httponly_cookie.html");

[mmenke, 2016/02/19 17:34:42]

What was wrong here?  Looks like that was a built-in URL in the test server: 
https://code.google.com/p/chromium/codesearch#chromium/src/net/test/embedded_...

[Mike West, 2016/02/22 10:06:15]

Ah! It was failing because the HTTPS server wasn't set up correctly. I'll fix
that instead of adding these files; thanks for poking!

   GURL http_url = embedded_test_server()->GetURL("/frame_with_load_event.html");
 
   Shell* shell2 = CreateBrowser();
@@ -102,6 +102,26 @@ IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, Cookies) {
   EXPECT_EQ("B=2; D=4", GetCookieFromJS(web_contents_http->GetMainFrame()));
 }
 
+// SameSite cookies (that aren't marked as http-only) should be available to
+// JavaScript.
+IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, SameSiteCookies) {
+  host_resolver()->AddRule("*", "127.0.0.1");
+  ASSERT_TRUE(embedded_test_server()->Start());
+  SetupCrossSiteRedirector(embedded_test_server());
+
+  // The server sends a HttpOnly cookie. The RenderFrameMessageFilter should
+  // never allow this to be sent to any renderer process.

[mmenke, 2016/02/19 17:34:42]

This comment is incorrect.

[Mike West, 2016/02/22 10:06:15]

The dangers of cargo-culting a test... Thanks for catching it!

+  GURL url = embedded_test_server()->GetURL("/set_samesite_cookie.html");
+  NavigateToURL(shell(), url);
+
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  EXPECT_EQ("http://127.0.0.1/",
+            web_contents->GetSiteInstance()->GetSiteURL().spec());
+
+  EXPECT_EQ("samesite=1", GetCookieFromJS(web_contents->GetMainFrame()));
+}
+
 // The RenderFrameMessageFilter will kill processes when they access the cookies
 // of sites other than the site the process is dedicated to, under site
 // isolation.