Add custom interstitial for captive portals.

chrome/browser/captive_portal/captive_portal_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <map>
 #include <set>
+#include <string>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/files/file_path.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/message_loop/message_loop.h"
 #include "base/path_service.h"
 #include "base/prefs/pref_service.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/values.h"
 #include "chrome/browser/captive_portal/captive_portal_service.h"
 #include "chrome/browser/captive_portal/captive_portal_service_factory.h"
 #include "chrome/browser/captive_portal/captive_portal_tab_helper.h"
 #include "chrome/browser/captive_portal/captive_portal_tab_reloader.h"
 #include "chrome/browser/chrome_notification_types.h"
+#include "chrome/browser/interstitials/security_interstitial_page.h"
 #include "chrome/browser/net/url_request_mock_util.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ssl/captive_portal_blocking_page.h"
+#include "chrome/browser/ssl/ssl_blocking_page.h"
+#include "chrome/browser/ssl/ssl_error_handler.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_navigator.h"
 #include "chrome/browser/ui/tab_contents/tab_contents_iterator.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/interstitial_page.h"
+#include "content/public/browser/interstitial_page_delegate.h"
 #include "content/public/browser/navigation_controller.h"
+#include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test_utils.h"
 #include "net/base/net_errors.h"
 #include "net/http/transport_security_state.h"
 #include "net/test/url_request/url_request_failed_job.h"
 #include "net/test/url_request/url_request_mock_http_job.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "net/url_request/url_request_filter.h"
 #include "net/url_request/url_request_job.h"
 #include "net/url_request/url_request_status.h"
@@ skipping 48 matching lines @@
     "https://mock.captive.portal.long.timeout2/title2.html";
 
 // Same as kMockHttpsUrl, except the timeout happens instantly.
 const char* const kMockHttpsQuickTimeoutUrl =
     "https://mock.captive.portal.quick.timeout/title2.html";
 
 // Expected title of a tab once an HTTPS load completes, when not behind a
 // captive portal.
 const char* const kInternetConnectedTitle = "Title Of Awesomeness";
 
+// Wait until all resources have loaded in an interstitial page.
+bool WaitForInterstitialReady(content::InterstitialPage* interstitial) {
+  content::RenderViewHost* rvh = interstitial->GetRenderViewHostForTesting();
+  if (!rvh)
+    return false;
+  bool load_complete = false;
+  EXPECT_TRUE(
+      content::ExecuteScriptAndExtractBool(
+          rvh->GetMainFrame(),
+          "(function() {"
+          "  var done = false;"
+          "  function checkState() {"
+          "    if (!done && document.readyState == 'complete') {"
+          "      done = true;"
+          "      window.domAutomationController.send(true);"
+          "    }"
+          "  }"
+          "  checkState();"
+          "  document.addEventListener('readystatechange', checkState);"
+          "})();",
+          &load_complete));
+  return load_complete;
+}
+
 // A URL request job that hangs until FailJobs() is called.  Started jobs
 // are stored in a static class variable containing a linked list so that
 // FailJobs() can locate them.
 class URLRequestTimeoutOnDemandJob : public net::URLRequestJob,
                                      public base::NonThreadSafe {
  public:
   // net::URLRequestJob:
   void Start() override;
 
   // All the public static methods below can be called on any thread.
 
   // Waits for exactly |num_jobs|.
   static void WaitForJobs(int num_jobs);
 
   // Fails all active URLRequestTimeoutOnDemandJobs with connection timeouts.
   // There are expected to be exactly |expected_num_jobs| waiting for
-  // failure.  The only way to gaurantee this is with an earlier call to
+  // failure.  The only way to guarantee this is with an earlier call to
   // WaitForJobs, so makes sure there has been a matching WaitForJobs call.
   static void FailJobs(int expected_num_jobs);
 
+  // Fails all active URLRequestTimeoutOnDemandJobs with SSL cert errors.
+  // |expected_num_jobs| behaves just as in FailJobs.
+  static void FailJobsWithCertError(int expected_num_jobs);
+
   // Abandon all active URLRequestTimeoutOnDemandJobs.  |expected_num_jobs|
   // behaves just as in FailJobs.
   static void AbandonJobs(int expected_num_jobs);
 
  private:
   friend class URLRequestMockCaptivePortalJobFactory;
 
   // Operation to perform on jobs when removing them from |job_list_|.
   enum EndJobOperation {
     FAIL_JOBS,
     ABANDON_JOBS,
+    FAIL_JOBS_WITH_CERT_ERROR
   };
 
   URLRequestTimeoutOnDemandJob(net::URLRequest* request,
                                net::NetworkDelegate* network_delegate);
   ~URLRequestTimeoutOnDemandJob() override;
 
   // Attempts to removes |this| from |jobs_|.  Returns true if it was removed
   // from the list.
   bool RemoveFromList();
 
@@ skipping 66 matching lines @@
 // static
 void URLRequestTimeoutOnDemandJob::FailJobs(int expected_num_jobs) {
   content::BrowserThread::PostTask(
       content::BrowserThread::IO, FROM_HERE,
       base::Bind(&URLRequestTimeoutOnDemandJob::FailOrAbandonJobsOnIOThread,
                  expected_num_jobs,
                  FAIL_JOBS));
 }
 
 // static
+void URLRequestTimeoutOnDemandJob::FailJobsWithCertError(
+    int expected_num_jobs) {
+  content::BrowserThread::PostTask(
+      content::BrowserThread::IO, FROM_HERE,
+      base::Bind(&URLRequestTimeoutOnDemandJob::FailOrAbandonJobsOnIOThread,
+                 expected_num_jobs,
+                 FAIL_JOBS_WITH_CERT_ERROR));
+}
+
+// static
 void URLRequestTimeoutOnDemandJob::AbandonJobs(int expected_num_jobs) {
   content::BrowserThread::PostTask(
       content::BrowserThread::IO, FROM_HERE,
       base::Bind(&URLRequestTimeoutOnDemandJob::FailOrAbandonJobsOnIOThread,
                  expected_num_jobs,
                  ABANDON_JOBS));
 }
 
 URLRequestTimeoutOnDemandJob::URLRequestTimeoutOnDemandJob(
     net::URLRequest* request, net::NetworkDelegate* network_delegate)
@@ skipping 67 matching lines @@
   while (job_list_) {
     ++num_jobs;
     URLRequestTimeoutOnDemandJob* job = job_list_;
     // Since the error notification may result in the job's destruction, remove
     // it from the job list before the error.
     EXPECT_TRUE(job->RemoveFromList());
     if (end_job_operation == FAIL_JOBS) {
       job->NotifyStartError(net::URLRequestStatus(
                                 net::URLRequestStatus::FAILED,
                                 net::ERR_CONNECTION_TIMED_OUT));
+    } else if (end_job_operation == FAIL_JOBS_WITH_CERT_ERROR) {
+      ASSERT_TRUE(job->request()->url().SchemeIs(url::kHttpsScheme));
+      net::SSLInfo info;
+      info.cert_status = net::CERT_STATUS_COMMON_NAME_INVALID;
+      info.cert = new net::X509Certificate(
+          "bad.host", "CA", base::Time::Max(), base::Time::Max());
+      job->NotifySSLCertificateError(info, true);
     }
   }
 
   EXPECT_EQ(expected_num_jobs, num_jobs_started_);
   EXPECT_EQ(expected_num_jobs, num_jobs);
 
   num_jobs_started_ -= expected_num_jobs;
 }
 
 // URLRequestCaptivePortalJobFactory emulates captive portal behavior.
@@ skipping 356 matching lines @@
     base::MessageLoopForUI::current()->Quit();
   }
 }
 
 // An observer for watching the CaptivePortalService.  It tracks the last
 // received result and the total number of received results.
 class CaptivePortalObserver : public content::NotificationObserver {
  public:
   explicit CaptivePortalObserver(Profile* profile);
 
-  // Runs the message loop until until at exactly |update_count| capitive portal
-  // results have been received, since this creation of |this|.  Expects no
+  // Runs the message loop until exactly |update_count| captive portal
+  // results have been received, since the creation of |this|.  Expects no
   // additional captive portal results.
   void WaitForResults(int num_results_to_wait_for);
 
   int num_results_received() const { return num_results_received_; }
 
   CaptivePortalResult captive_portal_result() const {
     return captive_portal_result_;
   }
 
  private:
@@ skipping 66 matching lines @@
   captive_portal_result_ = results->result;
   ++num_results_received_;
 
   if (waiting_for_result_ &&
       num_results_to_wait_for_ == num_results_received_) {
     waiting_for_result_ = false;
     base::MessageLoop::current()->Quit();
   }
 }
 
+// This observer waits for the SSLErrorHandler to fire an interstitial timer for
+// the given web contents.
+class SSLInterstitialTimerObserver {
+ public:
+  explicit SSLInterstitialTimerObserver(content::WebContents* web_contents);
+  ~SSLInterstitialTimerObserver();
+
+  // Waits until the interstitial delay timer in SSLErrorHandler is fired.
+  void WaitForTimerFired();
+
+ private:
+  void OnTimerFired(content::WebContents* web_contents);
+
+  const content::WebContents* web_contents_;
+  SSLErrorHandler::TimerFiredCallback callback_;
+
+  scoped_refptr<content::MessageLoopRunner> message_loop_runner_;
+
+  DISALLOW_COPY_AND_ASSIGN(SSLInterstitialTimerObserver);
+};
+
+SSLInterstitialTimerObserver::SSLInterstitialTimerObserver(
+    content::WebContents* web_contents)
+    : web_contents_(web_contents) {
+  callback_ = base::Bind(&SSLInterstitialTimerObserver::OnTimerFired,
+                         base::Unretained(this));
+  SSLErrorHandler::SetInterstitialTimerFiredCallbackForTest(&callback_);
+}
+
+SSLInterstitialTimerObserver::~SSLInterstitialTimerObserver() {
+  SSLErrorHandler::SetInterstitialTimerFiredCallbackForTest(nullptr);
+}
+
+void SSLInterstitialTimerObserver::WaitForTimerFired() {
+  message_loop_runner_ = new content::MessageLoopRunner;

[Bernhard Bauer, 2014/12/19 10:14:25]

You may want to initialize the message loop runner earlier, e.g. in the
constructor. Otherwise the OnTimerFired might happen too early, and then you
won't ever quit the message loop.

It could be that it's guaranteed that OnTimerFired will run later, but setting
up the message loop runner early is still the safer pattern (for example in case
someone else copies this code).

[meacer, 2014/12/19 19:04:23]

Done.

+  message_loop_runner_->Run();
+}
+
+void SSLInterstitialTimerObserver::OnTimerFired(
+    content::WebContents* web_contents) {
+  if (web_contents_ == web_contents && message_loop_runner_.get())
+    message_loop_runner_->Quit();
+}
+
 // Adds an HSTS rule for |host|, so that all HTTP requests sent to it will
 // be switched to HTTPS requests.
 void AddHstsHost(net::URLRequestContextGetter* context_getter,
                  const std::string& host) {
   ASSERT_TRUE(BrowserThread::CurrentlyOn(BrowserThread::IO));
   net::TransportSecurityState* transport_security_state =
       context_getter->GetURLRequestContext()->transport_security_state();
   if (!transport_security_state) {
     FAIL();
     return;
@@ skipping 11 matching lines @@
   CaptivePortalBrowserTest();
 
   // InProcessBrowserTest:
   void SetUpOnMainThread() override;
   void TearDownOnMainThread() override;
 
   // Sets the captive portal checking preference.  Does not affect the command
   // line flag, which is set in SetUpCommandLine.
   void EnableCaptivePortalDetection(Profile* profile, bool enabled);
 
+  // Enables or disables actual captive portal probes. Should only be called
+  // after captive portal service setup is done. When disabled, probe requests
+  // are silently ignored, never receiving a response.
+  void RespondToProbeRequests(bool enabled);
+
   // Sets up the captive portal service for the given profile so that
   // all checks go to |test_url|.  Also disables all timers.
   void SetUpCaptivePortalService(Profile* profile, const GURL& test_url);
 
   // Returns true if |browser|'s profile is currently running a captive portal
   // check.
   bool CheckPending(Browser* browser);
 
+  // Returns the type of the interstitial being shown.
+  const void* GetInterstitialType(WebContents* contents) const;
+
   // Returns the CaptivePortalTabReloader::State of |web_contents|.
   CaptivePortalTabReloader::State GetStateOfTabReloader(
       WebContents* web_contents) const;
 
   // Returns the CaptivePortalTabReloader::State of the indicated tab.
   CaptivePortalTabReloader::State GetStateOfTabReloaderAt(Browser* browser,
                                                           int index) const;
 
   // Returns the number of tabs with the given state, across all profiles.
   int NumTabsWithState(CaptivePortalTabReloader::State state) const;
@@ skipping 61 matching lines @@
 
   // Just like SlowLoadBehindCaptivePortal, except the navigated tab has
   // a connection timeout rather having its time trigger, and the function
   // waits until that timeout occurs.
   void FastTimeoutBehindCaptivePortal(Browser* browser,
                                       bool expect_open_login_tab);
 
   // Much as above, but accepts a URL parameter and can be used for errors that
   // trigger captive portal checks other than timeouts.  |error_url| should
   // result in an error rather than hanging.
-  void FastErrorBehindCaptivePortal(Browser* browser,
-                                    bool expect_open_login_tab,
-                                    const GURL& error_url);
+  // If |delay_portal_response_until_interstital| is true, captive portal probe
+  // request are ignored until the interstitial is shown, at which point a
+  // captive portal result is sent. This allows testing in conjunction with the
+  // certificate error interstitial.
+  void FastErrorBehindCaptivePortal(
+      Browser* browser,
+      bool expect_open_login_tab,
+      const GURL& error_url,
+      bool delay_portal_response_until_interstital);
+
+  // Navigates the active tab to an SSL error page which triggers an
+  // interstitial timer. Also disables captive portal checks indefinitely, so
+  // the page appears to be hanging.
+  void FastErrorWithInterstitialTimer(Browser* browser,
+                                      const GURL& cert_error_url);
 
   // Navigates the login tab without logging in.  The login tab must be the
   // specified browser's active tab.  Expects no other tab to change state.
   // |num_loading_tabs| and |num_timed_out_tabs| are used as extra checks
   // that nothing has gone wrong prior to the function call.
   void NavigateLoginTab(Browser* browser,
                         int num_loading_tabs,
                         int num_timed_out_tabs);
 
   // Simulates a login by updating the URLRequestMockCaptivePortalJob's
   // behind captive portal state, and navigating the login tab.  Waits for
   // all broken but not loading tabs to be reloaded.
   // |num_loading_tabs| and |num_timed_out_tabs| are used as extra checks
   // that nothing has gone wrong prior to the function call.
   void Login(Browser* browser, int num_loading_tabs, int num_timed_out_tabs);
 
+  // Simulates a login when the broken tab shows an SSL or captive portal
+  // interstitial. Can't use Login() in those cases because the interstitial
+  // tab looks like a cross between a hung tab (Load was never committed) and a
+  // tab at an error page (The load was stopped).
+  void LoginCertError(Browser* browser);
+
   // Makes the slow SSL loads of all active tabs time out at once, and waits for
   // them to finish both that load and the automatic reload it should trigger.
   // There should be no timed out tabs when this is called.
   void FailLoadsAfterLogin(Browser* browser, int num_loading_tabs);
 
   // Makes the slow SSL loads of all active tabs time out at once, and waits for
   // them to finish displaying their error pages.  The login tab should be the
   // active tab.  There should be no timed out tabs when this is called.
   void FailLoadsWithoutLogin(Browser* browser, int num_loading_tabs);
 
@@ skipping 42 matching lines @@
             CaptivePortalService::get_state_for_testing());
 
   CaptivePortalService::set_state_for_testing(
       CaptivePortalService::SKIP_OS_CHECK_FOR_TESTING);
   EnableCaptivePortalDetection(browser()->profile(), true);
 
   // Set the captive portal service to use URLRequestMockCaptivePortalJob's
   // mock URL, by default.
   SetUpCaptivePortalService(browser()->profile(),
                             GURL(kMockCaptivePortalTestUrl));
+
+  // Set SSL interstitial delay long enough so that a captive portal result
+  // is guaranteed to arrive during this window, and a captive portal
+  // error page is displayed instead of an SSL interstitial.
+  SSLErrorHandler::SetInterstitialDisplayDelayForTest(
+      base::TimeDelta::FromHours(1));
 }
 
 void CaptivePortalBrowserTest::TearDownOnMainThread() {
   // No test should have a captive portal check pending on quit.
   EXPECT_FALSE(CheckPending(browser()));
 }
 
 void CaptivePortalBrowserTest::EnableCaptivePortalDetection(
     Profile* profile, bool enabled) {
   profile->GetPrefs()->SetBoolean(prefs::kAlternateErrorPagesEnabled, enabled);
 }
 
+void CaptivePortalBrowserTest::RespondToProbeRequests(bool enabled) {
+  if (enabled) {
+    EXPECT_EQ(CaptivePortalService::IGNORE_REQUESTS_FOR_TESTING,
+              CaptivePortalService::get_state_for_testing());
+    CaptivePortalService::set_state_for_testing(
+        CaptivePortalService::SKIP_OS_CHECK_FOR_TESTING);
+  } else {
+    EXPECT_EQ(CaptivePortalService::SKIP_OS_CHECK_FOR_TESTING,
+              CaptivePortalService::get_state_for_testing());
+    CaptivePortalService::set_state_for_testing(
+        CaptivePortalService::IGNORE_REQUESTS_FOR_TESTING);
+  }
+}
+
 void CaptivePortalBrowserTest::SetUpCaptivePortalService(Profile* profile,
                                                          const GURL& test_url) {
   CaptivePortalService* captive_portal_service =
       CaptivePortalServiceFactory::GetForProfile(profile);
   captive_portal_service->set_test_url(test_url);
 
   // Don't use any non-zero timers.  Timers are checked in unit tests.
   CaptivePortalService::RecheckPolicy* recheck_policy =
       &captive_portal_service->recheck_policy();
   recheck_policy->initial_backoff_no_portal_ms = 0;
   recheck_policy->initial_backoff_portal_ms = 0;
   recheck_policy->backoff_policy.maximum_backoff_ms = 0;
 }
 
 bool CaptivePortalBrowserTest::CheckPending(Browser* browser) {
   CaptivePortalService* captive_portal_service =
       CaptivePortalServiceFactory::GetForProfile(browser->profile());
 
   return captive_portal_service->DetectionInProgress() ||
       captive_portal_service->TimerRunning();
 }
 
+const void* CaptivePortalBrowserTest::GetInterstitialType(
+    WebContents* contents) const {
+  if (!contents->ShowingInterstitialPage())
+    return nullptr;
+  SecurityInterstitialPage* blocking_page =
+      static_cast<SecurityInterstitialPage*>(
+          contents->GetInterstitialPage()->GetDelegateForTesting());
+  return blocking_page->GetTypeForTesting();
+}
+
 CaptivePortalTabReloader::State CaptivePortalBrowserTest::GetStateOfTabReloader(
     WebContents* web_contents) const {
   return GetTabReloader(web_contents)->state();
 }
 
 CaptivePortalTabReloader::State
 CaptivePortalBrowserTest::GetStateOfTabReloaderAt(Browser* browser,
                                                   int index) const {
   return GetStateOfTabReloader(
       browser->tab_strip_model()->GetWebContentsAt(index));
@@ skipping 212 matching lines @@
 
   // Reset the load time to be large, so the timer won't trigger on a reload.
   SetSlowSSLLoadTime(tab_reloader, base::TimeDelta::FromHours(1));
 }
 
 void CaptivePortalBrowserTest::FastTimeoutBehindCaptivePortal(
     Browser* browser,
     bool expect_open_login_tab) {
   FastErrorBehindCaptivePortal(browser,
                                expect_open_login_tab,
-                               GURL(kMockHttpsQuickTimeoutUrl));
+                               GURL(kMockHttpsQuickTimeoutUrl),
+                               false);
 }
 
 void CaptivePortalBrowserTest::FastErrorBehindCaptivePortal(
     Browser* browser,
     bool expect_open_login_tab,
-    const GURL& error_url) {
+    const GURL& error_url,
+    bool delay_portal_response_until_interstital) {
   TabStripModel* tab_strip_model = browser->tab_strip_model();
   // Calling this on a tab that's waiting for a load to manually be timed out
   // will result in a hang.
   ASSERT_FALSE(tab_strip_model->GetActiveWebContents()->IsLoading());
 
   // Set the load time to be large, so the timer won't trigger.  The value is
   // not restored at the end of the function.
   CaptivePortalTabReloader* tab_reloader =
       GetTabReloader(tab_strip_model->GetActiveWebContents());
   ASSERT_TRUE(tab_reloader);
   SetSlowSSLLoadTime(tab_reloader, base::TimeDelta::FromHours(1));
 
   // Number of tabs expected to be open after the captive portal checks
   // have completed.
   int initial_tab_count = tab_strip_model->count();
   int initial_active_index = tab_strip_model->active_index();
   int initial_loading_tabs = NumLoadingTabs();
   int expected_broken_tabs = NumBrokenTabs();
   if (CaptivePortalTabReloader::STATE_BROKEN_BY_PORTAL !=
           GetStateOfTabReloader(tab_strip_model->GetActiveWebContents())) {
     ++expected_broken_tabs;
   }
 
+  CaptivePortalService* captive_portal_service =
+      CaptivePortalServiceFactory::GetForProfile(browser->profile());
+  if (delay_portal_response_until_interstital)
+    RespondToProbeRequests(false);
+
   MultiNavigationObserver navigation_observer;
   CaptivePortalObserver portal_observer(browser->profile());
   ui_test_utils::NavigateToURLWithDisposition(browser,
                                               error_url,
                                               CURRENT_TAB,
                                               ui_test_utils::BROWSER_TEST_NONE);
+
+  if (delay_portal_response_until_interstital) {
+    EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+              GetStateOfTabReloaderAt(browser, initial_active_index));
+    // Once the interstitial is attached, probe for captive portal.
+    WaitForInterstitialAttach(tab_strip_model->GetActiveWebContents());
+    RespondToProbeRequests(true);
+    captive_portal_service->DetectCaptivePortal();
+  }
+
   portal_observer.WaitForResults(1);
 
   if (expect_open_login_tab) {
     navigation_observer.WaitForNavigations(2);
     ASSERT_EQ(initial_tab_count + 1, tab_strip_model->count());
     EXPECT_EQ(initial_tab_count, tab_strip_model->active_index());
     // Make sure that the originally active tab and the captive portal tab have
     // each loaded once.
     EXPECT_EQ(1, navigation_observer.NumNavigationsForTab(
                      tab_strip_model->GetWebContentsAt(initial_active_index)));
@@ skipping 15 matching lines @@
   EXPECT_EQ(expected_broken_tabs, NumBrokenTabs());
   EXPECT_EQ(captive_portal::RESULT_BEHIND_CAPTIVE_PORTAL,
             portal_observer.captive_portal_result());
   EXPECT_EQ(1, portal_observer.num_results_received());
   EXPECT_FALSE(CheckPending(browser));
 
   EXPECT_EQ(CaptivePortalTabReloader::STATE_BROKEN_BY_PORTAL,
             GetStateOfTabReloaderAt(browser, initial_active_index));
 }
 
+void CaptivePortalBrowserTest::FastErrorWithInterstitialTimer(
+    Browser* browser,
+    const GURL& cert_error_url) {
+  TabStripModel* tab_strip_model = browser->tab_strip_model();
+  WebContents* broken_tab_contents = tab_strip_model->GetActiveWebContents();
+
+  // Disable captive portal checks indefinitely.
+  RespondToProbeRequests(false);
+
+  SSLInterstitialTimerObserver interstitial_timer_observer(broken_tab_contents);
+  ui_test_utils::NavigateToURLWithDisposition(browser,
+                                              cert_error_url,
+                                              CURRENT_TAB,
+                                              ui_test_utils::BROWSER_TEST_NONE);
+  interstitial_timer_observer.WaitForTimerFired();
+
+  // The tab should be in loading state, waiting for the interstitial timer to
+  // expire or a captive portal result to arrive. Since captive portal checks
+  // are disabled and timer set to expire after a very long time, the tab should
+  // hang indefinitely.
+  EXPECT_TRUE(broken_tab_contents->IsLoading());
+  EXPECT_EQ(1, NumLoadingTabs());
+}
+
 void CaptivePortalBrowserTest::NavigateLoginTab(Browser* browser,
                                                 int num_loading_tabs,
                                                 int num_timed_out_tabs) {
   MultiNavigationObserver navigation_observer;
   CaptivePortalObserver portal_observer(browser->profile());
 
   TabStripModel* tab_strip_model = browser->tab_strip_model();
   int initial_tab_count = tab_strip_model->count();
   EXPECT_EQ(num_loading_tabs, NumLoadingTabs());
   EXPECT_EQ(num_timed_out_tabs, NumBrokenTabs() - NumLoadingTabs());
 
   int login_tab_index = tab_strip_model->active_index();
   EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
             GetStateOfTabReloader(tab_strip_model->GetActiveWebContents()));
   ASSERT_TRUE(IsLoginTab(browser->tab_strip_model()->GetActiveWebContents()));
 
   // Do the navigation.
-  content::RenderFrameHost* render_frame_host =
-      tab_strip_model->GetActiveWebContents()->GetMainFrame();
-  render_frame_host->ExecuteJavaScript(base::ASCIIToUTF16("submitForm()"));
+  EXPECT_TRUE(content::ExecuteScript(tab_strip_model->GetActiveWebContents(),
+                                     "submitForm()"));
 
   portal_observer.WaitForResults(1);
   navigation_observer.WaitForNavigations(1);
 
   // Check the captive portal result.
   EXPECT_EQ(captive_portal::RESULT_BEHIND_CAPTIVE_PORTAL,
             portal_observer.captive_portal_result());
   EXPECT_EQ(1, portal_observer.num_results_received());
   EXPECT_FALSE(CheckPending(browser));
 
@@ skipping 24 matching lines @@
   ASSERT_EQ(num_loading_tabs, NumLoadingTabs());
   EXPECT_EQ(num_timed_out_tabs, NumBrokenTabs() - NumLoadingTabs());
 
   // Verify that the login page is on top.
   int login_tab_index = tab_strip_model->active_index();
   EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
             GetStateOfTabReloaderAt(browser, login_tab_index));
   ASSERT_TRUE(IsLoginTab(tab_strip_model->GetWebContentsAt(login_tab_index)));
 
   // Trigger a navigation.
-  content::RenderFrameHost* render_frame_host =
-      tab_strip_model->GetActiveWebContents()->GetMainFrame();
-  render_frame_host->ExecuteJavaScript(base::ASCIIToUTF16("submitForm()"));
+  EXPECT_TRUE(content::ExecuteScript(tab_strip_model->GetActiveWebContents(),
+                                     "submitForm()"));
 
   portal_observer.WaitForResults(1);
 
   // Wait for all the timed out tabs to reload.
   navigation_observer.WaitForNavigations(1 + num_timed_out_tabs);
   EXPECT_EQ(1, portal_observer.num_results_received());
 
   // The tabs that were loading before should still be loading, and now be in
   // STATE_NEEDS_RELOAD.
   EXPECT_EQ(0, NumBrokenTabs());
   EXPECT_EQ(num_loading_tabs, NumLoadingTabs());
   EXPECT_EQ(num_loading_tabs, NumNeedReloadTabs());
 
   // Make sure that the broken tabs have reloaded, and there's no more
   // captive portal tab.
   EXPECT_EQ(initial_tab_count, tab_strip_model->count());
   EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
             GetStateOfTabReloaderAt(browser, login_tab_index));
   EXPECT_FALSE(IsLoginTab(tab_strip_model->GetWebContentsAt(login_tab_index)));
 
   // Make sure there were no unexpected navigations of the login tab.
   EXPECT_EQ(1, navigation_observer.NumNavigationsForTab(
                    tab_strip_model->GetWebContentsAt(login_tab_index)));
 }
 
+void CaptivePortalBrowserTest::LoginCertError(Browser* browser) {
+  URLRequestMockCaptivePortalJobFactory::SetBehindCaptivePortal(false);
+
+  MultiNavigationObserver navigation_observer;
+  CaptivePortalObserver portal_observer(browser->profile());
+
+  TabStripModel* tab_strip_model = browser->tab_strip_model();
+
+  // Verify that the login page is on top.
+  int login_tab_index = tab_strip_model->active_index();
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+            GetStateOfTabReloaderAt(browser, login_tab_index));
+  ASSERT_TRUE(IsLoginTab(tab_strip_model->GetWebContentsAt(login_tab_index)));
+
+  // Trigger a navigation.
+  EXPECT_TRUE(content::ExecuteScript(tab_strip_model->GetActiveWebContents(),
+                                     "submitForm()"));
+
+  // The captive portal tab navigation will trigger a captive portal check,
+  // and reloading the original tab will bring up the interstitial page again,
+  // triggering a second captive portal check.
+  portal_observer.WaitForResults(2);
+
+  // Wait for both tabs to finish loading.
+  navigation_observer.WaitForNavigations(2);
+  EXPECT_EQ(2, portal_observer.num_results_received());
+  EXPECT_FALSE(CheckPending(browser));
+  EXPECT_EQ(captive_portal::RESULT_INTERNET_CONNECTED,
+            portal_observer.captive_portal_result());
+
+  // Check state of tabs.  While the first tab is still displaying an
+  // interstitial page, since no portal was found, it should be in STATE_NONE,
+  // as should the login tab.
+  ASSERT_EQ(2, tab_strip_model->count());
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+            GetStateOfTabReloaderAt(browser, 0));
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+            GetStateOfTabReloaderAt(browser, login_tab_index));
+  EXPECT_FALSE(IsLoginTab(tab_strip_model->GetWebContentsAt(login_tab_index)));
+
+  // Make sure only one navigation was for the login tab.
+  EXPECT_EQ(1, navigation_observer.NumNavigationsForTab(
+                   tab_strip_model->GetWebContentsAt(login_tab_index)));
+}
+
 void CaptivePortalBrowserTest::FailLoadsAfterLogin(Browser* browser,
                                                    int num_loading_tabs) {
   ASSERT_EQ(num_loading_tabs, NumLoadingTabs());
   ASSERT_EQ(num_loading_tabs, NumNeedReloadTabs());
   EXPECT_EQ(0, NumBrokenTabs());
 
   TabStripModel* tab_strip_model = browser->tab_strip_model();
   int initial_num_tabs = tab_strip_model->count();
   int initial_active_tab = tab_strip_model->active_index();
 
@@ skipping 278 matching lines @@
 }
 
 // Checks the unlikely case that the tab times out before the timer triggers.
 // This most likely won't happen, but should still work:
 IN_PROC_BROWSER_TEST_F(CaptivePortalBrowserTest, LoginFastTimeout) {
   FastTimeoutBehindCaptivePortal(browser(), true);
   Login(browser(), 0, 1);
 }
 
 // A cert error triggers a captive portal check and results in opening a login
-// tab.  The user then logs in and the page with the error is reloaded.
-IN_PROC_BROWSER_TEST_F(CaptivePortalBrowserTest, SSLCertErrorLogin) {
-  // Need an HTTP TestServer to handle a dynamically created server redirect.
-  ASSERT_TRUE(test_server()->Start());
-
+// tab.
+IN_PROC_BROWSER_TEST_F(CaptivePortalBrowserTest,
+                       ShowCaptivePortalInterstitialOnCertError) {
   net::SpawnedTestServer::SSLOptions https_options;
   https_options.server_certificate =
       net::SpawnedTestServer::SSLOptions::CERT_MISMATCHED_NAME;
   net::SpawnedTestServer https_server(
       net::SpawnedTestServer::TYPE_HTTPS, https_options,
       base::FilePath(FILE_PATH_LITERAL("chrome/test/data")));
   ASSERT_TRUE(https_server.Start());
 
-  // The path does not matter.
-  GURL cert_error_url = https_server.GetURL(kTestServerLoginPath);
+  TabStripModel* tab_strip_model = browser()->tab_strip_model();
+  WebContents* broken_tab_contents = tab_strip_model->GetActiveWebContents();
+
+  // The path does not matter.
+  GURL cert_error_url = https_server.GetURL(kTestServerLoginPath);
+  int cert_error_tab_index = tab_strip_model->active_index();
   // The interstitial should trigger a captive portal check when it opens, just
   // like navigating to kMockHttpsQuickTimeoutUrl.
-  FastErrorBehindCaptivePortal(browser(), true, cert_error_url);
-
-  // Simulate logging in.  Can't use Login() because the interstitial tab looks
-  // like a cross between a hung tab (Load was never committed) and a tab at an
-  // error page (The load was stopped).
-  URLRequestMockCaptivePortalJobFactory::SetBehindCaptivePortal(false);
+  FastErrorBehindCaptivePortal(browser(), true, cert_error_url, false);
+  EXPECT_EQ(CaptivePortalBlockingPage::kTypeForTesting,
+            GetInterstitialType(broken_tab_contents));
+
+  // Switch to the interstitial and click the |Connect| button. Should switch
+  // active tab to the captive portal landing page.
+  int login_tab_index = tab_strip_model->active_index();
+  tab_strip_model->ActivateTabAt(cert_error_tab_index, false);
+  // Wait for the interstitial to load all the JavaScript code. Otherwise,
+  // trying to click on a button will fail.
+  EXPECT_TRUE(WaitForInterstitialReady(
+      broken_tab_contents->GetInterstitialPage()));
+  content::RenderViewHost* rvh =
+      broken_tab_contents->GetInterstitialPage()->GetRenderViewHostForTesting();
+  const char kClickConnectButtonJS[] =
+      "document.getElementById('primary-button').click();";
+  EXPECT_TRUE(
+      content::ExecuteScript(rvh->GetMainFrame(), kClickConnectButtonJS));
+  EXPECT_EQ(login_tab_index, tab_strip_model->active_index());
+
+  // For completeness, close the login tab and try clicking |Connect| again.
+  // A new login tab should open.
+  EXPECT_EQ(1, login_tab_index);
+  content::WebContentsDestroyedWatcher destroyed_watcher(
+      tab_strip_model->GetActiveWebContents());
+  EXPECT_TRUE(
+      tab_strip_model->CloseWebContentsAt(tab_strip_model->active_index(), 0));
+  destroyed_watcher.Wait();
   MultiNavigationObserver navigation_observer;
+  EXPECT_TRUE(
+      content::ExecuteScript(rvh->GetMainFrame(), kClickConnectButtonJS));
+  navigation_observer.WaitForNavigations(1);
+  EXPECT_EQ(login_tab_index, tab_strip_model->active_index());
+
+  LoginCertError(browser());
+
+  // Once logged in, broken tab should reload and display the SSL interstitial.
+  WaitForInterstitialAttach(broken_tab_contents);
+  tab_strip_model->ActivateTabAt(cert_error_tab_index, false);
+
+  EXPECT_EQ(SSLBlockingPage::kTypeForTesting,
+            GetInterstitialType(tab_strip_model->GetActiveWebContents()));
+
+  // Trigger another captive portal check while the SSL interstitial is showing.
+  // At this point the user is logged in to the captive portal, so the captive
+  // portal interstitial shouldn't get recreated.
   CaptivePortalObserver portal_observer(browser()->profile());
-
-  TabStripModel* tab_strip_model = browser()->tab_strip_model();
-  content::RenderFrameHost* render_frame_host =
-      tab_strip_model->GetActiveWebContents()->GetMainFrame();
-  render_frame_host->ExecuteJavaScript(base::ASCIIToUTF16("submitForm()"));
-
-  // The captive portal tab navigation will trigger a captive portal check,
-  // and reloading the original tab will bring up the interstitial page again,
-  // triggering a second captive portal check.
-  portal_observer.WaitForResults(2);
-
-  // Wait for both tabs to finish loading.
-  navigation_observer.WaitForNavigations(2);
-  EXPECT_EQ(2, portal_observer.num_results_received());
-  EXPECT_FALSE(CheckPending(browser()));
-  EXPECT_EQ(captive_portal::RESULT_INTERNET_CONNECTED,
-            portal_observer.captive_portal_result());
-
-  // Check state of tabs.  While the first tab is still displaying an
-  // interstitial page, since no portal was found, it should be in STATE_NONE,
-  // as should the login tab.
-  ASSERT_EQ(2, tab_strip_model->count());
-  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
-            GetStateOfTabReloaderAt(browser(), 0));
-  EXPECT_FALSE(IsLoginTab(tab_strip_model->GetWebContentsAt(1)));
-  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
-            GetStateOfTabReloaderAt(browser(), 1));
-
-  // Make sure only one navigation was for the login tab.
-  EXPECT_EQ(1, navigation_observer.NumNavigationsForTab(
-                   tab_strip_model->GetWebContentsAt(1)));
+  CaptivePortalService* captive_portal_service =
+      CaptivePortalServiceFactory::GetForProfile(browser()->profile());
+  captive_portal_service->DetectCaptivePortal();
+  portal_observer.WaitForResults(1);
+  EXPECT_EQ(SSLBlockingPage::kTypeForTesting,
+            GetInterstitialType(broken_tab_contents));
+
+  // A captive portal appears. Trigger a final captive portal check. The
+  // captive portal interstitial should still not get recreated.
+  URLRequestMockCaptivePortalJobFactory::SetBehindCaptivePortal(true);
+  CaptivePortalObserver final_portal_observer(browser()->profile());
+  captive_portal_service->DetectCaptivePortal();
+  final_portal_observer.WaitForResults(1);
+  EXPECT_EQ(SSLBlockingPage::kTypeForTesting,
+            GetInterstitialType(broken_tab_contents));
+}
+
+// Tests this scenario:
+// - Portal probe requests are ignored, so that no captive portal result can
+//   arrive.
+// - A cert error triggers an interstitial timer with a very long timeout.
+// - No captive portal results arrive, causing the tab to appear as loading
+//   indefinitely (because probe requests are ignored).
+// - Stopping the page load shouldn't result in any interstitials.
+IN_PROC_BROWSER_TEST_F(CaptivePortalBrowserTest,
+                       InterstitialTimerStopNavigationWhileLoading) {
+  net::SpawnedTestServer::SSLOptions https_options;
+  https_options.server_certificate =
+      net::SpawnedTestServer::SSLOptions::CERT_MISMATCHED_NAME;
+  net::SpawnedTestServer https_server(
+      net::SpawnedTestServer::TYPE_HTTPS, https_options,
+      base::FilePath(FILE_PATH_LITERAL("chrome/test/data")));
+  ASSERT_TRUE(https_server.Start());
+  // The path does not matter.
+  GURL cert_error_url = https_server.GetURL(kTestServerLoginPath);
+
+  TabStripModel* tab_strip_model = browser()->tab_strip_model();
+  WebContents* broken_tab_contents = tab_strip_model->GetActiveWebContents();
+
+  CaptivePortalObserver portal_observer1(browser()->profile());
+  FastErrorWithInterstitialTimer(browser(), cert_error_url);
+
+  // Page appears loading. Stop the navigation. There should be no interstitial.
+  MultiNavigationObserver test_navigation_observer;
+  broken_tab_contents->Stop();
+  test_navigation_observer.WaitForNavigations(1);
+
+  EXPECT_FALSE(broken_tab_contents->ShowingInterstitialPage());
+  EXPECT_FALSE(broken_tab_contents->IsLoading());
+  EXPECT_EQ(0, portal_observer1.num_results_received());
+  EXPECT_EQ(0, NumLoadingTabs());
+  EXPECT_FALSE(CheckPending(browser()));
+  EXPECT_EQ(1, browser()->tab_strip_model()->count());
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+            GetStateOfTabReloaderAt(browser(), 0));
+
+  // Re-enable captive portal checks and fire one. The result should be ignored.
+  RespondToProbeRequests(true);
+  CaptivePortalObserver portal_observer2(browser()->profile());
+  CaptivePortalService* captive_portal_service =
+      CaptivePortalServiceFactory::GetForProfile(browser()->profile());
+  captive_portal_service->DetectCaptivePortal();
+  portal_observer2.WaitForResults(1);
+
+  EXPECT_FALSE(broken_tab_contents->ShowingInterstitialPage());
+  EXPECT_FALSE(broken_tab_contents->IsLoading());
+  EXPECT_EQ(1, portal_observer2.num_results_received());
+  EXPECT_EQ(captive_portal::RESULT_BEHIND_CAPTIVE_PORTAL,
+            portal_observer2.captive_portal_result());
+  EXPECT_EQ(0, NumLoadingTabs());
+  EXPECT_FALSE(CheckPending(browser()));
+  EXPECT_EQ(1, browser()->tab_strip_model()->count());
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+            GetStateOfTabReloaderAt(browser(), 0));
+}
+
+// Same as above, but instead of stopping, the loading page is reloaded. The end
+// result is the same. (i.e. page load stops, no interstitials shown)
+IN_PROC_BROWSER_TEST_F(CaptivePortalBrowserTest,
+                       InterstitialTimerReloadWhileLoading) {
+  net::SpawnedTestServer::SSLOptions https_options;
+  https_options.server_certificate =
+      net::SpawnedTestServer::SSLOptions::CERT_MISMATCHED_NAME;
+  net::SpawnedTestServer https_server(
+      net::SpawnedTestServer::TYPE_HTTPS, https_options,
+      base::FilePath(FILE_PATH_LITERAL("chrome/test/data")));
+  ASSERT_TRUE(https_server.Start());
+  // The path does not matter.
+  GURL cert_error_url = https_server.GetURL(kTestServerLoginPath);
+
+  TabStripModel* tab_strip_model = browser()->tab_strip_model();
+  WebContents* broken_tab_contents = tab_strip_model->GetActiveWebContents();
+
+  CaptivePortalObserver portal_observer(browser()->profile());
+  FastErrorWithInterstitialTimer(browser(), cert_error_url);
+
+  // Page appears loading. Reloading it cancels the page load. Since the load is
+  // stopped, no cert error occurs and SSLErrorHandler isn't instantiated.
+  MultiNavigationObserver test_navigation_observer;
+  chrome::Reload(browser(), CURRENT_TAB);
+  test_navigation_observer.WaitForNavigations(2);
+
+  EXPECT_FALSE(broken_tab_contents->ShowingInterstitialPage());
+  EXPECT_FALSE(broken_tab_contents->IsLoading());
+  EXPECT_EQ(0, portal_observer.num_results_received());
+  EXPECT_EQ(2, test_navigation_observer.num_navigations());
+  EXPECT_EQ(0, NumLoadingTabs());
+  EXPECT_FALSE(CheckPending(browser()));
+  EXPECT_EQ(1, browser()->tab_strip_model()->count());
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+            GetStateOfTabReloaderAt(browser(), 0));
+
+  // Re-enable captive portal checks and fire one. The result should be ignored.
+  RespondToProbeRequests(true);
+  CaptivePortalObserver portal_observer2(browser()->profile());
+  CaptivePortalService* captive_portal_service =
+      CaptivePortalServiceFactory::GetForProfile(browser()->profile());
+  captive_portal_service->DetectCaptivePortal();
+  portal_observer2.WaitForResults(1);
+
+  EXPECT_FALSE(broken_tab_contents->ShowingInterstitialPage());
+  EXPECT_FALSE(broken_tab_contents->IsLoading());
+  EXPECT_EQ(1, portal_observer2.num_results_received());
+  EXPECT_EQ(captive_portal::RESULT_BEHIND_CAPTIVE_PORTAL,
+            portal_observer2.captive_portal_result());
+  EXPECT_EQ(0, NumLoadingTabs());
+  EXPECT_FALSE(CheckPending(browser()));
+  EXPECT_EQ(1, browser()->tab_strip_model()->count());
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+            GetStateOfTabReloaderAt(browser(), 0));
+}
+
+// Same as above, but instead of reloading, the page is navigated away. The new
+// page should load, and no interstitials should be shown.
+IN_PROC_BROWSER_TEST_F(CaptivePortalBrowserTest,
+                       InterstitialTimerNavigateAwayWhileLoading) {
+  net::SpawnedTestServer::SSLOptions https_options;
+  https_options.server_certificate =
+      net::SpawnedTestServer::SSLOptions::CERT_MISMATCHED_NAME;
+  net::SpawnedTestServer https_server(
+      net::SpawnedTestServer::TYPE_HTTPS, https_options,
+      base::FilePath(FILE_PATH_LITERAL("chrome/test/data")));
+  ASSERT_TRUE(https_server.Start());
+  // The path does not matter.
+  GURL cert_error_url = https_server.GetURL(kTestServerLoginPath);
+
+  TabStripModel* tab_strip_model = browser()->tab_strip_model();
+  WebContents* broken_tab_contents = tab_strip_model->GetActiveWebContents();
+
+  CaptivePortalObserver portal_observer(browser()->profile());
+  FastErrorWithInterstitialTimer(browser(), cert_error_url);
+
+  // Page appears loading. Navigating away shouldn't result in any interstitial.
+  // Can't use ui_test_utils::NavigateToURLWithDisposition because it waits for
+  // a load stop notification before starting a new navigation.
+  MultiNavigationObserver test_navigation_observer;
+  browser()->OpenURL(content::OpenURLParams(
+      URLRequestMockHTTPJob::GetMockUrl(
+          base::FilePath(FILE_PATH_LITERAL("title2.html"))),
+      content::Referrer(),
+      CURRENT_TAB,
+      ui::PAGE_TRANSITION_TYPED, false));
+  // Expect two navigations: First one for stopping the hanging page, second one
+  // for completing the load of the above navigation.
+  test_navigation_observer.WaitForNavigations(2);
+
+  EXPECT_FALSE(broken_tab_contents->ShowingInterstitialPage());
+  EXPECT_FALSE(broken_tab_contents->IsLoading());
+  EXPECT_EQ(0, portal_observer.num_results_received());
+  EXPECT_EQ(2, test_navigation_observer.num_navigations());
+  EXPECT_EQ(0, NumLoadingTabs());
+  EXPECT_FALSE(CheckPending(browser()));
+  EXPECT_EQ(1, browser()->tab_strip_model()->count());
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+            GetStateOfTabReloaderAt(browser(), 0));
+
+  // Re-enable captive portal checks and fire one. The result should be ignored.
+  RespondToProbeRequests(true);
+  CaptivePortalObserver portal_observer2(browser()->profile());
+  CaptivePortalService* captive_portal_service =
+      CaptivePortalServiceFactory::GetForProfile(browser()->profile());
+  captive_portal_service->DetectCaptivePortal();
+  portal_observer2.WaitForResults(1);
+
+  EXPECT_FALSE(broken_tab_contents->ShowingInterstitialPage());
+  EXPECT_FALSE(broken_tab_contents->IsLoading());
+  EXPECT_EQ(1, portal_observer2.num_results_received());
+  EXPECT_EQ(captive_portal::RESULT_BEHIND_CAPTIVE_PORTAL,
+            portal_observer2.captive_portal_result());
+  EXPECT_EQ(0, NumLoadingTabs());
+  EXPECT_FALSE(CheckPending(browser()));
+  EXPECT_EQ(1, browser()->tab_strip_model()->count());
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NONE,
+            GetStateOfTabReloaderAt(browser(), 0));
+}
+
+// A cert error triggers a captive portal check and results in opening a login
+// tab.  The user then logs in and the page with the error is reloaded.
+IN_PROC_BROWSER_TEST_F(CaptivePortalBrowserTest, SSLCertErrorLogin) {
+  // Need an HTTP TestServer to handle a dynamically created server redirect.
+  ASSERT_TRUE(test_server()->Start());
+
+  net::SpawnedTestServer::SSLOptions https_options;
+  https_options.server_certificate =
+      net::SpawnedTestServer::SSLOptions::CERT_MISMATCHED_NAME;
+  net::SpawnedTestServer https_server(
+      net::SpawnedTestServer::TYPE_HTTPS, https_options,
+      base::FilePath(FILE_PATH_LITERAL("chrome/test/data")));
+  ASSERT_TRUE(https_server.Start());
+
+  // Set SSL interstitial delay to zero so that a captive portal result can not
+  // arrive during this window, so an SSL interstitial is displayed instead
+  // of a captive portal error page.
+  SSLErrorHandler::SetInterstitialDisplayDelayForTest(base::TimeDelta());
+  TabStripModel* tab_strip_model = browser()->tab_strip_model();
+  WebContents* broken_tab_contents = tab_strip_model->GetActiveWebContents();
+
+  // Setting the delay to zero above has a race condition: A captive portal
+  // result triggered by a cert error can arrive before the SSL interstitial
+  // display timer is fired, even though it's set to zero.
+  // To avoid this, disable captive portal checks until the SSL interstitial is
+  // displayed. Once it's displayed, enable portal checks and fire one.
+  bool delay_portal_response_until_interstital = true;
+
+  // The path does not matter.
+  GURL cert_error_url = https_server.GetURL(kTestServerLoginPath);
+  // A captive portal check is triggered in FastErrorBehindCaptivePortal.
+  FastErrorBehindCaptivePortal(
+      browser(),
+      true,
+      cert_error_url,
+      delay_portal_response_until_interstital);
+
+  EXPECT_EQ(SSLBlockingPage::kTypeForTesting,
+            GetInterstitialType(broken_tab_contents));
+
+  LoginCertError(browser());
 }
 
 // Tries navigating both the tab that encounters an SSL timeout and the
 // login tab twice, only logging in the second time.
 IN_PROC_BROWSER_TEST_F(CaptivePortalBrowserTest, LoginExtraNavigations) {
   FastTimeoutBehindCaptivePortal(browser(), true);
 
   // Activate the timed out tab and navigate it to a timeout again.
   TabStripModel* tab_strip_model = browser()->tab_strip_model();
   tab_strip_model->ActivateTabAt(0, true);
@@ skipping 432 matching lines @@
   content::BrowserThread::PostTask(
       content::BrowserThread::IO, FROM_HERE,
       base::Bind(&AddHstsHost,
                  make_scoped_refptr(browser()->profile()->GetRequestContext()),
                  http_timeout_url.host()));
 
   SlowLoadBehindCaptivePortal(browser(), true, http_timeout_url, 1, 1);
   Login(browser(), 1, 0);
   FailLoadsAfterLogin(browser(), 1);
 }
+
+// A slow SSL load starts. The reloader triggers a captive portal check, finds a
+// captive portal. The SSL commits with a cert error, triggering another captive
+// portal check.
+// The second check finds no captive portal. The reloader triggers a reload at
+// the same time SSL error handler tries to show an interstitial. Should result
+// in an SSL interstitial.
+IN_PROC_BROWSER_TEST_F(CaptivePortalBrowserTest,
+                       InterstitialTimerCertErrorAfterSlowLoad) {
+  // Use a url that triggers a slow load, instead of creating an https server.
+  GURL cert_error_url = GURL(kMockHttpsUrl);
+
+  TabStripModel* tab_strip_model = browser()->tab_strip_model();
+  int broken_tab_index = tab_strip_model->active_index();
+  WebContents* broken_tab_contents = tab_strip_model->GetActiveWebContents();
+  SlowLoadBehindCaptivePortal(browser(), true, cert_error_url, 1, 1);
+
+  // No longer behind a captive portal. Committing the SSL page should trigger
+  // an SSL interstitial which triggers a new captive portal check. Since there
+  // is no captive portal anymore, should end up with an SSL interstitial.
+  URLRequestMockCaptivePortalJobFactory::SetBehindCaptivePortal(false);
+
+  CaptivePortalObserver portal_observer(browser()->profile());
+  MultiNavigationObserver navigation_observer;
+  URLRequestTimeoutOnDemandJob::FailJobsWithCertError(1);
+  navigation_observer.WaitForNavigations(1);
+
+  EXPECT_EQ(CaptivePortalTabReloader::STATE_NEEDS_RELOAD,
+            GetStateOfTabReloaderAt(browser(), broken_tab_index));
+
+  WaitForInterstitialAttach(broken_tab_contents);
+  portal_observer.WaitForResults(1);
+
+  EXPECT_EQ(SSLBlockingPage::kTypeForTesting,
+            GetInterstitialType(broken_tab_contents));
+}