Allow view-source of pages fully-blocked by Blink's XSS filter.

content/browser/frame_host/navigation_controller_impl_unittest.cc

Index: content/browser/frame_host/navigation_controller_impl_unittest.cc
diff --git a/content/browser/frame_host/navigation_controller_impl_unittest.cc b/content/browser/frame_host/navigation_controller_impl_unittest.cc
index 6bb3d0e21b3cb74ca478ae00f019fc0c24b3da05..bd1ac439356f2259d5b8ccc452e446616a373730 100644
--- a/content/browser/frame_host/navigation_controller_impl_unittest.cc
+++ b/content/browser/frame_host/navigation_controller_impl_unittest.cc
@@ -4329,4 +4329,44 @@ TEST_F(NavigationControllerTest, PostThenReplaceStateThenReload) {
   EXPECT_EQ(0, delegate->repost_form_warning_count());
 }
 
+// Test that the navigation controller preserves an entry when a
+// "Blocking Page" is created.
+TEST_F(NavigationControllerTest, BlockingPageEntry) {
+  const GURL url1("http://foo1");
+  const GURL url2("http://foo2?x=<script>alert(0)</script>");
+  const GURL url3("data:,");
+  const GURL url4("http://foo4");
+
+  NavigationControllerImpl& controller = controller_impl();
+
+  // Set up the controller with initial history.
+  NavigateAndCommit(url1);
+  NavigateAndCommit(url2);
+  EXPECT_FALSE(controller.GetBlockedPageEntry());
+
+  // Pretend that XSS was detected by the renderer.
+  int32 page_id = controller.GetActiveEntry()->GetPageID();
+  contents()->OnDidDetectXSS(page_id, url2, true);
+  EXPECT_TRUE(controller.GetBlockedPageEntry());
+  EXPECT_EQ(url2, controller.GetBlockedPageEntry()->GetURL());
+
+  // Pretend that a "Blocking Page" replacement navigation followed.
+  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  params.page_id = page_id;
+  params.url = url3;
+  params.transition = PAGE_TRANSITION_LINK;
+  params.gesture = NavigationGestureUser;
+  params.page_state = PageState::CreateFromURL(params.url);
+  params.was_within_same_page = true;
+  params.is_post = false;
+  params.post_id = -1;
+  test_rvh()->SendNavigateWithParams(&params);
+  EXPECT_TRUE(controller.GetBlockedPageEntry());
+  EXPECT_EQ(url2, controller.GetBlockedPageEntry()->GetURL());
+
+  // Check that further navigation clears the entry.
+  NavigateAndCommit(url4);
+  EXPECT_FALSE(controller.GetBlockedPageEntry());
+}
+
 }  // namespace content