Update from https://crrev.com/316786

url/url_canon_relative.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Canonicalizer functions for working with and resolving relative URLs.
 
 #include "base/logging.h"
 #include "url/url_canon.h"
 #include "url/url_canon_internal.h"
 #include "url/url_constants.h"
@@ skipping 152 matching lines @@
   }
 
   // Two or more slashes after the scheme we treat as absolute.
   return true;
 }
 
 // Copies all characters in the range [begin, end) of |spec| to the output,
 // up until and including the last slash. There should be a slash in the
 // range, if not, nothing will be copied.
 //
-// The input is assumed to be canonical, so we search only for exact slashes
-// and not backslashes as well. We also know that it's ASCII.
+// For stardard URLs the input should be canonical, but when resolving relative
+// URLs on a non-standard base (like "data:") the input can be anything.
 void CopyToLastSlash(const char* spec,
                      int begin,
                      int end,
                      CanonOutput* output) {
   // Find the last slash.
   int last_slash = -1;
   for (int i = end - 1; i >= begin; i--) {
-    if (spec[i] == '/') {
+    if (spec[i] == '/' || spec[i] == '\\') {
       last_slash = i;
       break;
     }
   }
   if (last_slash < 0)
     return;  // No slash.
 
   // Copy.
   for (int i = begin; i <= last_slash; i++)
     output->push_back(spec[i]);
@@ skipping 358 matching lines @@
                         const Component& relative_component,
                         CharsetConverter* query_converter,
                         CanonOutput* output,
                         Parsed* out_parsed) {
   return DoResolveRelativeURL<base::char16>(
       base_url, base_parsed, base_is_file, relative_url,
       relative_component, query_converter, output, out_parsed);
 }
 
 }  // namespace url