Add test case to see if HTTP auth interstitials work nicely with other interstitials

chrome/browser/ui/login/login_prompt.cc

Index: chrome/browser/ui/login/login_prompt.cc
diff --git a/chrome/browser/ui/login/login_prompt.cc b/chrome/browser/ui/login/login_prompt.cc
index 53f68a7b4a8f518502bdf7c005e1aaa274b15769..4af671385261a87cffa45481aa9a662b763e28d5 100644
--- a/chrome/browser/ui/login/login_prompt.cc
+++ b/chrome/browser/ui/login/login_prompt.cc
@@ -509,15 +509,21 @@ void LoginDialogCallback(const GURL& request_url,
     return;
   }
 
+  // For main frame navigations, show a blank interstitial if this is a cross
+  // origin request or if there is an existing interstitial.

[msw, 2014/08/01 17:09:47]

It sounds like this could clobber or hide the first (potentially important)
interstitial, but the test seems to indicate that it'll show the interstitials
in sequence. Can you clarify this comment and potentially merge it with the
other two comments in the first block?

Can you also expand the CL description and have a second reviewer familiar with
interstitials take a look, since the owners here aren't terribly familiar with
the code and causes for concern? +CC creis, since he reviewed r273358.

Review from someone on the security team would be great too. +CC jschuh, in case
he can take a look or ping someone who ought to take a look.

Bonus points if you post a screencast of the repro steps with and without this
patch on the bug :)

[meacer, 2014/08/01 17:25:56]

Ah, good point. The assumption at the time of writing the CL was that we could
only reach this point when the user proceeds through the first interstitial, and
that it wouldn't be possible to show a login prompt on top of an existing
interstitial. But after recent discussions, it's clear that when a malware
interstitial is displayed, the page still keeps running in the background, so it
might be possible to show an auth prompt on top of the existing interstitial.
That I believe can hide the malware interstitial. I'm going to test that.
I'll give it a shot :)

   if (is_main_frame &&
-      parent_contents->GetVisibleURL().GetOrigin() != request_url.GetOrigin()) {
+      (parent_contents->GetInterstitialPage() ||
+       parent_contents->GetVisibleURL().GetOrigin() != request_url.GetOrigin())
+      ) {
     // Show a blank interstitial for main-frame, cross origin requests
     // so that the correct URL is shown in the omnibox.
     base::Closure callback = base::Bind(&ShowLoginPrompt,
                                         request_url,
                                         make_scoped_refptr(auth_info),
                                         make_scoped_refptr(handler));
-    // This is owned by the interstitial it creates.
+
+    // This is owned by the interstitial it creates. The new interstitial will
+    // replace existing interstitial, if any.
     new LoginInterstitialDelegate(parent_contents,
                                   request_url,
                                   callback);