Crash on unexpected URL change.

Bug: 841105
Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
Change-Id: I4471a98cdef13e54b790ebcd565d59c67dba8bfd
Reviewed-on: https://chromium-review.googlesource.com/1054196Reviewed-by: Rohit Rao <rohitrao@chromium.org>
Reviewed-by: Danyao Wang <danyao@chromium.org>
Commit-Queue: Eugene But <eugenebut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#558760}

ios/web/features.mm

@@ -22,5 +22,8 @@ const base::Feature kWebErrorPages{"WebErrorPages",
 const base::Feature kWKHTTPSystemCookieStore{"WKHTTPSystemCookieStore",
                                              base::FEATURE_DISABLED_BY_DEFAULT};
 
+const base::Feature kCrashOnUnexpectedURLChange{
+    "CrashOnUnexpectedURLChange", base::FEATURE_ENABLED_BY_DEFAULT};
+
 }  // namespace features
 }  // namespace web

ios/web/public/features.h

@@ -25,6 +25,10 @@ extern const base::Feature kWebErrorPages;
 // Used to enable using WKHTTPSystemCookieStore in main context URL requests.
 extern const base::Feature kWKHTTPSystemCookieStore;
 
+// Used to crash the browser if unexpected URL change is detected.
+// https://crbug.com/841105.
+extern const base::Feature kCrashOnUnexpectedURLChange;
+
 }  // namespace features
 }  // namespace web
 

ios/web/web_state/ui/crw_web_controller.mm

@@ -5203,6 +5203,17 @@ registerLoadRequestForURL:(const GURL&)requestURL
 
 - (void)URLDidChangeWithoutDocumentChange:(const GURL&)newURL {
   DCHECK(newURL == net::GURLWithNSURL([_webView URL]));
+
+  if (base::FeatureList::IsEnabled(
+          web::features::kCrashOnUnexpectedURLChange)) {
+    if (_documentURL.GetOrigin() != newURL.GetOrigin()) {
+      if (newURL.username().find(_documentURL.host()) != std::string::npos ||
+          newURL.password().find(_documentURL.host()) != std::string::npos) {
+        CHECK(false);
+      }
+    }
+  }
+
   DCHECK_EQ(_documentURL.host(), newURL.host());
   DCHECK(_documentURL != newURL);