Handle webuis when using the network service.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index c6eba025ea5c4d162b5984c5139dbe037b73b38d..d0ac34fb6dad26ca0f0951087e3fb6d7ee1551f8 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -59,6 +59,7 @@
 #include "content/browser/shared_worker/shared_worker_service_impl.h"
 #include "content/browser/websockets/websocket_manager.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
+#include "content/browser/webui/web_ui_url_loader_factory.h"
 #include "content/common/accessibility_messages.h"
 #include "content/common/associated_interface_provider_impl.h"
 #include "content/common/associated_interface_registry_impl.h"
@@ -3048,7 +3049,16 @@ void RenderFrameHostImpl::CommitNavigation(
   FrameMsg_CommitDataNetworkService_Params commit_data;
   commit_data.handle = handle.release();
   // TODO(scottmg): Pass a factory for SW, etc. once we have one.
-  commit_data.url_loader_factory = mojo::MessagePipeHandle();
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableNetworkService) &&
+      common_params.url.SchemeIs(kChromeUIScheme)) {
+    commit_data.url_loader_factory = GetWebUIURLLoader(frame_tree_node_)
+                                         .PassInterface()
+                                         .PassHandle()
+                                         .release();
+  } else {
+    commit_data.url_loader_factory = mojo::MessagePipeHandle();
+  }
   Send(new FrameMsg_CommitNavigation(routing_id_, head, body_url, commit_data,
                                      common_params, request_params));