Add test to check for crash caused by stale WebContents in chrome://interstitials

BUG=611706

Review-Url: https://codereview.chromium.org/2618573002
Cr-Commit-Position: refs/heads/master@{#441798}

chrome/browser/ui/webui/interstitials/interstitial_ui.cc

@@ -343,6 +343,11 @@ void InterstitialHTMLSource::StartDataRequest(
     const content::ResourceRequestInfo::WebContentsGetter& wc_getter,
     const content::URLDataSource::GotDataCallback& callback) {
   content::WebContents* web_contents = wc_getter.Run();
+  if (!web_contents) {
+    // When browser-side navigation is enabled, web_contents can be null if
+    // the tab is closing. Nothing to do in this case.
+    return;
+  }
   std::unique_ptr<content::InterstitialPageDelegate> interstitial_delegate;
   if (base::StartsWith(path, "ssl", base::CompareCase::SENSITIVE)) {
     interstitial_delegate.reset(CreateSSLBlockingPage(web_contents));

chrome/browser/ui/webui/interstitials/interstitial_ui_browsertest.cc

@@ -7,6 +7,7 @@
 #include "chrome/browser/devtools/devtools_window.h"
 #include "chrome/browser/devtools/devtools_window_testing.h"
 #include "chrome/browser/ui/browser.h"
+#include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
@@ -84,3 +85,20 @@ IN_PROC_BROWSER_TEST_F(InterstitialUITest, CaptivePortalInterstitialWifi) {
   TestInterstitial(GURL("chrome://interstitials/captiveportal?is_wifi=1"),
                    "Connect to Wi-Fi");
 }
+
+// Checks that the interstitial page uses correct web contents. If not, closing
+// the tab might result in a freed web contents pointer and cause a crash.
+// See https://crbug.com/611706 for details.
+IN_PROC_BROWSER_TEST_F(InterstitialUITest, UseCorrectWebContents) {
+  int current_tab = browser()->tab_strip_model()->active_index();
+  ui_test_utils::NavigateToURL(browser(), GURL("chrome://interstitials/ssl"));
+
+  // Duplicate the tab and close it.
+  chrome::DuplicateTab(browser());
+  EXPECT_NE(current_tab, browser()->tab_strip_model()->active_index());
+  chrome::CloseTab(browser());
+  EXPECT_EQ(current_tab, browser()->tab_strip_model()->active_index());
+
+  // Reloading the page shouldn't cause a crash.
+  chrome::Reload(browser(), WindowOpenDisposition::CURRENT_TAB);
+}