Cleanup of static lists of schemes & origins that are created at startup.

chrome/common/secure_origin_whitelist.h

Index: chrome/common/secure_origin_whitelist.h
diff --git a/chrome/common/secure_origin_whitelist.h b/chrome/common/secure_origin_whitelist.h
index 02e1f2438b384fef8ae91f59f621513e241146d7..d885c044e8eee7fbe6ef19ffc7f18a5fc57ba912 100644
--- a/chrome/common/secure_origin_whitelist.h
+++ b/chrome/common/secure_origin_whitelist.h
@@ -6,6 +6,8 @@
 #define CHROME_COMMON_SECURE_ORIGIN_WHITELIST_H_
 
 #include <set>
+#include <string>
+#include <vector>
 
 #include "url/gurl.h"
 
@@ -13,7 +15,7 @@
 // need to be considered trustworthy.  The whitelist is given by
 // kUnsafelyTreatInsecureOriginAsSecure command-line option.
 // See https://www.w3.org/TR/powerful-features/#is-origin-trustworthy.
-void GetSecureOriginWhitelist(std::set<GURL>* origins);
+void GetSecureOriginWhitelist(std::vector<std::string>* origins);

[brettw, 2017/01/10 18:58:17]

Why did the type change to string? The results look like they're just given to
GURL constructor. If we're passing URLs around, I think they should be GURL
objects. (vector change seems good)

Optional: if we are changing this a return value is cleaner. Then in the caller
you can even do:
  for (auto& origin : GetSecureOriginWhitelist()) ...

[jam, 2017/01/10 19:16:33]

This is for consistency with all the other parameters to the ContentClient
method which are strings. Since the source data for all these parameters are
string constants, it didn't seem to matter whether the caller wraps it with a
GURL or the receiver does it in this one case.
changed to return value and the method below while i was at it

[brettw, 2017/01/10 20:19:45]

But the other things in the list are schemes which aren't URLs. In fact, when I
saw the Schemes object and that one of them was listed as "origins", I
questioned what exactly that meant. Is it canonical? Does it have a slash after
the host name? What can you compare it to? 

Sending as a GURL resolves all of these questions with no documentation.

[jam, 2017/01/10 21:01:37]

ok, done

 
 // |schemes| is a return value parameter that gets a whitelist of schemes that
 // should bypass the Is Privileged Context check.