Revert "OOR-CORS: Remove BlinkCORS related tests"

This reverts commit 7d2bed26.

Reason for revert: No good reason, but this build causes a compilation error. No clear culprit. https://ci.chromium.org/p/chromium/builders/ci/Mac%20ASan%2064%20Builder/104190

Original change's description:
> OOR-CORS: Remove BlinkCORS related tests
> 
> This patch removes network::features::kOutOfBlinkCors and
> network::features::ShouldEnableOutOfBlinkCorsForTesting() references
> from existing tests as now BlinkCors was deprecated, and we already
> turned down CORS fyi bots.
> 
> This is part of the work to remove the kOutOfBlinkCors feature.
> 
> Bug: 1053866
> Change-Id: I4ba14005fd3fb310cbd246e6c0bd6cc18bd005d8
> TBR: mkwst@chromium.org
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2377633
> Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
> Reviewed-by: Matt Falkenhagen <falken@chromium.org>
> Reviewed-by: Karan Bhatia <karandeepb@chromium.org>
> Reviewed-by: Łukasz Anforowicz <lukasza@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#803029}

TBR=falken@chromium.org,toyoshim@chromium.org,lukasza@chromium.org,karandeepb@chromium.org,mkwst@chromium.org

Change-Id: I96044df30b8694433c6bad6e9eb719b949f6413e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: 1053866
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2385075Reviewed-by: Maxim Kolosovskiy  <kolos@chromium.org>
Commit-Queue: Maxim Kolosovskiy  <kolos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803044}

chrome/browser/extensions/fetch_apitest.cc

@@ -325,8 +325,9 @@ IN_PROC_BROWSER_TEST_P(ExtensionFetchPostOriginTest,
       embedded_test_server()->GetURL("example.com", "/echo-origin");
   std::string script = content::JsReplace(kFetchPostScript, destination_url);
   std::string origin_string =
-      GetParam() ? url::Origin::Create(destination_url).Serialize()
-                 : url::Origin::Create(extension->url()).Serialize();
+      network::features::ShouldEnableOutOfBlinkCorsForTesting() && GetParam()
+          ? url::Origin::Create(destination_url).Serialize()
+          : url::Origin::Create(extension->url()).Serialize();
   EXPECT_EQ(origin_string,
             ExecuteScriptInBackgroundPage(extension->id(), script));
 }

chrome/browser/loader/cors_origin_access_list_browsertest.cc

@@ -12,6 +12,7 @@
 #include "base/strings/string16.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/test/scoped_feature_list.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/test/base/in_process_browser_test.h"
@@ -21,6 +22,7 @@
 #include "content/public/test/browser_test_utils.h"
 #include "net/base/host_port_pair.h"
 #include "net/dns/mock_host_resolver.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/mojom/cors.mojom.h"
 #include "services/network/public/mojom/cors_origin_pattern.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -43,8 +45,11 @@ const char kTestSubdomainHost[] = "subdomain.crossorigin.example.com";
 // Tests end to end functionality of CORS access origin allow lists.
 class CorsOriginAccessListBrowserTest : public InProcessBrowserTest {
  protected:
-  CorsOriginAccessListBrowserTest() = default;
-
+  CorsOriginAccessListBrowserTest() {
+    // This test verifies if the CorsOriginAccessList works with OOR-CORS.
+    scoped_feature_list_.InitAndEnableFeature(
+        network::features::kOutOfBlinkCors);
+  }
   std::unique_ptr<content::TitleWatcher> CreateWatcher() {
     // Register all possible result strings here.
     std::unique_ptr<content::TitleWatcher> watcher =
@@ -133,6 +138,8 @@ class CorsOriginAccessListBrowserTest : public InProcessBrowserTest {
   const base::string16 fail_string_ = base::ASCIIToUTF16("FAIL");
   const base::string16 script_ = base::ASCIIToUTF16("reason");
 
+  base::test::ScopedFeatureList scoped_feature_list_;
+
   DISALLOW_COPY_AND_ASSIGN(CorsOriginAccessListBrowserTest);
 };
 

chrome/test/base/testing_profile.cc

@@ -882,7 +882,7 @@ void TestingProfile::SetCreationTimeForTesting(base::Time creation_time) {
 }
 
 bool TestingProfile::ShouldEnableOutOfBlinkCors() {
-  return true;
+  return network::features::ShouldEnableOutOfBlinkCorsForTesting();
 }
 
 PrefService* TestingProfile::GetOffTheRecordPrefs() {

chrome/test/origin_policy/origin_policy_browsertest.cc

@@ -13,6 +13,7 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
+#include "services/network/public/cpp/features.h"
 
 namespace {
 const base::FilePath::CharType kDataRoot[] =
@@ -121,6 +122,8 @@ IN_PROC_BROWSER_TEST_F(OriginPolicyBrowserTest, ApplyPolicy) {
 }
 
 IN_PROC_BROWSER_TEST_F(OriginPolicyBrowserTest, ErrorPolicy301Redirect) {
+  if (!base::FeatureList::IsEnabled(network::features::kOutOfBlinkCors))
+    return;
   SetStatus(net::HTTP_MOVED_PERMANENTLY);
   SetLocationHeader("/.well-known/origin-policy/example-policy");
   EXPECT_EQ(base::ASCIIToUTF16(kErrorInterstitialTitle),
@@ -128,6 +131,8 @@ IN_PROC_BROWSER_TEST_F(OriginPolicyBrowserTest, ErrorPolicy301Redirect) {
 }
 
 IN_PROC_BROWSER_TEST_F(OriginPolicyBrowserTest, ErrorPolicy302Redirect) {
+  if (!base::FeatureList::IsEnabled(network::features::kOutOfBlinkCors))
+    return;
   SetStatus(net::HTTP_FOUND);
   SetLocationHeader("/.well-known/origin-policy/example-policy");
   EXPECT_EQ(base::ASCIIToUTF16(kErrorInterstitialTitle),
@@ -135,6 +140,8 @@ IN_PROC_BROWSER_TEST_F(OriginPolicyBrowserTest, ErrorPolicy302Redirect) {
 }
 
 IN_PROC_BROWSER_TEST_F(OriginPolicyBrowserTest, ErrorPolicy307Redirect) {
+  if (!base::FeatureList::IsEnabled(network::features::kOutOfBlinkCors))
+    return;
   SetStatus(net::HTTP_TEMPORARY_REDIRECT);
   SetLocationHeader("/.well-known/origin-policy/example-policy");
   EXPECT_EQ(base::ASCIIToUTF16(kErrorInterstitialTitle),

content/browser/loader/cors_preflight_cache_browsertest.cc

@@ -20,6 +20,7 @@
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/test/embedded_test_server/request_handler_util.h"
 #include "services/network/public/cpp/cors/cors.h"
+#include "services/network/public/cpp/features.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
@@ -110,14 +111,15 @@ IN_PROC_BROWSER_TEST_F(CorsPreflightCacheBrowserTest, Default) {
   EXPECT_EQ(2u, get_count());
 
   // Make another fetch request with reload cache mode, and it should not hit
-  // the preflight cache.
+  // the preflight cache. Only OOR-CORS mode take the cache mode count in.
   std::unique_ptr<TitleWatcher> watcher3 =
       std::make_unique<TitleWatcher>(shell()->web_contents(), kTestDone);
   EXPECT_TRUE(NavigateToURL(
       shell(), embedded_test_server()->GetURL(base::StringPrintf(
                    "%s?;%d;reload", kTestPath, cross_origin_port()))));
   EXPECT_EQ(kTestDone, watcher3->WaitAndGetTitle());
-  EXPECT_EQ(2u, options_count());
+  EXPECT_EQ(network::features::ShouldEnableOutOfBlinkCorsForTesting() ? 2u : 1u,
+            options_count());
   EXPECT_EQ(3u, get_count());
 }
 

content/browser/network_service_browsertest.cc

@@ -425,9 +425,85 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest, SyncCookieGetOnCrash) {
   // If the renderer is hung the test will hang.
 }
 
+class NetworkServiceInProcessBrowserTest : public ContentBrowserTest {
+ public:
+  NetworkServiceInProcessBrowserTest() {
+    std::vector<base::Feature> features;
+    features.push_back(features::kNetworkServiceInProcess);
+    scoped_feature_list_.InitWithFeatures(features,
+                                          std::vector<base::Feature>());
+  }
+
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+    EXPECT_TRUE(embedded_test_server()->Start());
+  }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+
+  DISALLOW_COPY_AND_ASSIGN(NetworkServiceInProcessBrowserTest);
+};
+
+// Verifies that in-process network service works.
+IN_PROC_BROWSER_TEST_F(NetworkServiceInProcessBrowserTest, Basic) {
+  GURL test_url = embedded_test_server()->GetURL("foo.com", "/echo");
+  StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
+      BrowserContext::GetDefaultStoragePartition(
+          shell()->web_contents()->GetBrowserContext()));
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+  ASSERT_EQ(net::OK,
+            LoadBasicRequest(partition->GetNetworkContext(), test_url));
+}
+
+class NetworkServiceInvalidLogBrowserTest : public ContentBrowserTest {
+ public:
+  NetworkServiceInvalidLogBrowserTest() {}
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    command_line->AppendSwitchASCII(network::switches::kLogNetLog, "/abc/def");
+  }
+
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+    EXPECT_TRUE(embedded_test_server()->Start());
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(NetworkServiceInvalidLogBrowserTest);
+};
+
+// Verifies that an invalid --log-net-log flag won't crash the browser.
+IN_PROC_BROWSER_TEST_F(NetworkServiceInvalidLogBrowserTest, Basic) {
+  GURL test_url = embedded_test_server()->GetURL("foo.com", "/echo");
+  StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
+      BrowserContext::GetDefaultStoragePartition(
+          shell()->web_contents()->GetBrowserContext()));
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+  ASSERT_EQ(net::OK,
+            LoadBasicRequest(partition->GetNetworkContext(), test_url));
+}
+
+// TODO(yhirano): Merge this to NetworkServiceTest when OOR_CORS is enabled by
+// default.
+class NetworkServiceWithCorsBrowserTest : public NetworkServiceBrowserTest {
+ public:
+  NetworkServiceWithCorsBrowserTest() {
+    scoped_feature_list_.InitAndEnableFeature(
+        network::features::kOutOfBlinkCors);
+  }
+  NetworkServiceWithCorsBrowserTest(const NetworkServiceWithCorsBrowserTest&) =
+      delete;
+  NetworkServiceWithCorsBrowserTest& operator=(
+      const NetworkServiceWithCorsBrowserTest&) = delete;
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+};
+
 // Tests that CORS is performed by the network service when |factory_override|
 // is used.
-IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest, FactoryOverride) {
+IN_PROC_BROWSER_TEST_F(NetworkServiceWithCorsBrowserTest, FactoryOverride) {
   class TestURLLoaderFactory final : public network::mojom::URLLoaderFactory {
    public:
     void CreateLoaderAndStart(
@@ -524,65 +600,6 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest, FactoryOverride) {
   EXPECT_TRUE(test_loader_factory->has_received_request());
 }
 
-class NetworkServiceInProcessBrowserTest : public ContentBrowserTest {
- public:
-  NetworkServiceInProcessBrowserTest() {
-    std::vector<base::Feature> features;
-    features.push_back(features::kNetworkServiceInProcess);
-    scoped_feature_list_.InitWithFeatures(features,
-                                          std::vector<base::Feature>());
-  }
-
-  void SetUpOnMainThread() override {
-    host_resolver()->AddRule("*", "127.0.0.1");
-    EXPECT_TRUE(embedded_test_server()->Start());
-  }
-
- private:
-  base::test::ScopedFeatureList scoped_feature_list_;
-
-  DISALLOW_COPY_AND_ASSIGN(NetworkServiceInProcessBrowserTest);
-};
-
-// Verifies that in-process network service works.
-IN_PROC_BROWSER_TEST_F(NetworkServiceInProcessBrowserTest, Basic) {
-  GURL test_url = embedded_test_server()->GetURL("foo.com", "/echo");
-  StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
-      BrowserContext::GetDefaultStoragePartition(
-          shell()->web_contents()->GetBrowserContext()));
-  EXPECT_TRUE(NavigateToURL(shell(), test_url));
-  ASSERT_EQ(net::OK,
-            LoadBasicRequest(partition->GetNetworkContext(), test_url));
-}
-
-class NetworkServiceInvalidLogBrowserTest : public ContentBrowserTest {
- public:
-  NetworkServiceInvalidLogBrowserTest() = default;
-
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    command_line->AppendSwitchASCII(network::switches::kLogNetLog, "/abc/def");
-  }
-
-  void SetUpOnMainThread() override {
-    host_resolver()->AddRule("*", "127.0.0.1");
-    EXPECT_TRUE(embedded_test_server()->Start());
-  }
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(NetworkServiceInvalidLogBrowserTest);
-};
-
-// Verifies that an invalid --log-net-log flag won't crash the browser.
-IN_PROC_BROWSER_TEST_F(NetworkServiceInvalidLogBrowserTest, Basic) {
-  GURL test_url = embedded_test_server()->GetURL("foo.com", "/echo");
-  StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
-      BrowserContext::GetDefaultStoragePartition(
-          shell()->web_contents()->GetBrowserContext()));
-  EXPECT_TRUE(NavigateToURL(shell(), test_url));
-  ASSERT_EQ(net::OK,
-            LoadBasicRequest(partition->GetNetworkContext(), test_url));
-}
-
 // Test fixture for using a NetworkService that has a non-default limit on the
 // number of allowed open UDP sockets.
 class NetworkServiceWithUDPSocketLimit : public NetworkServiceBrowserTest {

content/browser/service_worker/service_worker_browsertest.cc

@@ -193,12 +193,16 @@ std::unique_ptr<net::test_server::HttpResponse> VerifySaveDataHeaderInRequest(
 std::unique_ptr<net::test_server::HttpResponse>
 VerifySaveDataNotInAccessControlRequestHeader(
     const net::test_server::HttpRequest& request) {
-  if (request.method == net::test_server::METHOD_OPTIONS) {
-    // 'Save-Data' is not added to the CORS preflight request.
+  if (request.method == net::test_server::METHOD_OPTIONS &&
+      network::features::ShouldEnableOutOfBlinkCorsForTesting()) {
+    // In OOR-CORS mode, 'Save-Data' is not added to the CORS preflight request.
+    // This is the desired behavior.
     auto it = request.headers.find("Save-Data");
     EXPECT_EQ(request.headers.end(), it);
   } else {
-    // 'Save-Data' is added to the actual request, as expected.
+    // In the legacy code path, 'Save-Data' is (undesirably) added to the
+    // preflight request. And in both code paths, 'Save-Data' is added to the
+    // actual request, as expected.
     auto it = request.headers.find("Save-Data");
     EXPECT_NE(request.headers.end(), it);
     EXPECT_EQ("on", it->second);

content/renderer/service_worker/service_worker_subresource_loader_unittest.cc

@@ -15,7 +15,9 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/test/metrics/histogram_tester.h"
+#include "base/test/scoped_feature_list.h"
 #include "content/common/service_worker/service_worker_utils.h"
+#include "content/public/common/content_features.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/renderer/service_worker/controller_service_worker_connector.h"
 #include "content/test/fake_network_url_loader_factory.h"
@@ -24,6 +26,7 @@
 #include "net/http/http_util.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_data_pipe_getter.h"
 #include "services/network/test/test_url_loader_client.h"
@@ -1382,6 +1385,87 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, TooManyRedirects) {
                                       net::URLRequest::kMaxRedirects + 1);
 }
 
+// Test when the service worker responds with network fallback to CORS request.
+TEST_F(ServiceWorkerSubresourceLoaderTest, CorsFallbackResponseWithoutOORCors) {
+  base::test::ScopedFeatureList test_features;
+  test_features.InitAndDisableFeature(network::features::kOutOfBlinkCors);
+
+  fake_controller_.RespondWithFallback();
+
+  mojo::Remote<network::mojom::URLLoaderFactory> factory =
+      CreateSubresourceLoaderFactory();
+
+  struct TestCase {
+    network::mojom::RequestMode request_mode;
+    base::Optional<url::Origin> request_initiator;
+    bool expected_was_fallback_required_by_service_worker;
+  };
+  const TestCase kTests[] = {
+      {network::mojom::RequestMode::kSameOrigin, base::Optional<url::Origin>(),
+       false},
+      {network::mojom::RequestMode::kNoCors, base::Optional<url::Origin>(),
+       false},
+      {network::mojom::RequestMode::kCors, base::Optional<url::Origin>(), true},
+      {network::mojom::RequestMode::kCorsWithForcedPreflight,
+       base::Optional<url::Origin>(), true},
+      {network::mojom::RequestMode::kNavigate, base::Optional<url::Origin>(),
+       false},
+      {network::mojom::RequestMode::kSameOrigin,
+       url::Origin::Create(GURL("https://www.example.com/")), false},
+      {network::mojom::RequestMode::kNoCors,
+       url::Origin::Create(GURL("https://www.example.com/")), false},
+      {network::mojom::RequestMode::kCors,
+       url::Origin::Create(GURL("https://www.example.com/")), false},
+      {network::mojom::RequestMode::kCorsWithForcedPreflight,
+       url::Origin::Create(GURL("https://www.example.com/")), false},
+      {network::mojom::RequestMode::kNavigate,
+       url::Origin::Create(GURL("https://other.example.com/")), false},
+      {network::mojom::RequestMode::kSameOrigin,
+       url::Origin::Create(GURL("https://other.example.com/")), false},
+      {network::mojom::RequestMode::kNoCors,
+       url::Origin::Create(GURL("https://other.example.com/")), false},
+      {network::mojom::RequestMode::kCors,
+       url::Origin::Create(GURL("https://other.example.com/")), true},
+      {network::mojom::RequestMode::kCorsWithForcedPreflight,
+       url::Origin::Create(GURL("https://other.example.com/")), true},
+      {network::mojom::RequestMode::kNavigate,
+       url::Origin::Create(GURL("https://other.example.com/")), false}};
+
+  for (const auto& test : kTests) {
+    base::HistogramTester histogram_tester;
+
+    SCOPED_TRACE(
+        ::testing::Message()
+        << "fetch_request_mode: " << static_cast<int>(test.request_mode)
+        << " request_initiator: "
+        << (test.request_initiator ? test.request_initiator->Serialize()
+                                   : std::string("null")));
+    // Perform the request.
+    network::ResourceRequest request =
+        CreateRequest(GURL("https://www.example.com/foo.png"));
+    request.mode = test.request_mode;
+    request.request_initiator = test.request_initiator;
+    mojo::Remote<network::mojom::URLLoader> loader;
+    std::unique_ptr<network::TestURLLoaderClient> client;
+    StartRequest(factory, request, &loader, &client);
+    client->RunUntilComplete();
+
+    auto& info = client->response_head();
+    EXPECT_EQ(test.expected_was_fallback_required_by_service_worker,
+              info->was_fetched_via_service_worker);
+    EXPECT_EQ(test.expected_was_fallback_required_by_service_worker,
+              info->was_fallback_required_by_service_worker);
+    if (info->was_fallback_required_by_service_worker) {
+      EXPECT_EQ("HTTP/1.1 400 Service Worker Fallback Required",
+                info->headers->GetStatusLine());
+    }
+    histogram_tester.ExpectTotalCount(
+        "ServiceWorker.LoadTiming.Subresource."
+        "FetchHandlerEndToFallbackNetwork",
+        1);
+  }
+}
+
 TEST_F(ServiceWorkerSubresourceLoaderTest, FallbackWithRequestBody_String) {
   const std::string kData = "Hi, this is the request body (string)";
   auto request_body = base::MakeRefCounted<network::ResourceRequestBody>();

content/test/trust_token_browsertest.cc

@@ -611,6 +611,13 @@ IN_PROC_BROWSER_TEST_F(TrustTokenBrowsertest,
 IN_PROC_BROWSER_TEST_F(
     TrustTokenBrowsertest,
     CorsModeCrossOriginRedirectIssuanceUsesNewOriginAsIssuer) {
+  // This test's first release is M86, where Blink-CORS is unconditionally
+  // unavailable (even via enterprise policy). Add this early return (okayed by
+  // Blink-CORS OWNERS) to avoid failing Blink-CORS FYI bots for the next week
+  // and a half until they are deleted.
+  if (!base::FeatureList::IsEnabled(network::features::kOutOfBlinkCors))
+    return;
+
   ProvideRequestHandlerKeyCommitmentsToNetworkService({"a.test", "b.test"});
 
   GURL start_url = server_.GetURL("a.test", "/title1.html");
@@ -643,6 +650,13 @@ IN_PROC_BROWSER_TEST_F(
 IN_PROC_BROWSER_TEST_F(
     TrustTokenBrowsertest,
     NoCorsModeCrossOriginRedirectIssuanceUsesOriginalOriginAsIssuer) {
+  // This test's first release is M86, where Blink-CORS is unconditionally
+  // unavailable (even via enterprise policy). Add this early return (okayed by
+  // Blink-CORS OWNERS) to avoid failing Blink-CORS FYI bots for the next week
+  // and a half until they are deleted.
+  if (!base::FeatureList::IsEnabled(network::features::kOutOfBlinkCors))
+    return;
+
   ProvideRequestHandlerKeyCommitmentsToNetworkService({"a.test"});
 
   GURL start_url = server_.GetURL("a.test", "/title1.html");

services/network/cors/cors_url_loader_factory_unittest.cc

@@ -50,6 +50,8 @@ class CorsURLLoaderFactoryTest : public testing::Test {
  protected:
   // testing::Test implementation.
   void SetUp() override {
+    feature_list_.InitAndEnableFeature(features::kOutOfBlinkCors);
+
     network_service_ = NetworkService::CreateForTesting();
 
     auto context_params = mojom::NetworkContextParams::New();
@@ -92,6 +94,9 @@ class CorsURLLoaderFactoryTest : public testing::Test {
   void ResetFactory() { cors_url_loader_factory_.reset(); }
 
  private:
+  // Testing instance to enable kOutOfBlinkCors feature.
+  base::test::ScopedFeatureList feature_list_;
+
   // Test environment.
   base::test::TaskEnvironment task_environment_;
   std::unique_ptr<net::URLRequestContext> url_request_context_;

services/network/cors/cors_url_loader_unittest.cc

@@ -33,6 +33,7 @@
 #include "services/network/cors/cors_url_loader_factory.h"
 #include "services/network/network_context.h"
 #include "services/network/network_service.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/mojom/cors.mojom.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
@@ -158,6 +159,9 @@ class CorsURLLoaderTest : public testing::Test {
  protected:
   // testing::Test implementation.
   void SetUp(network::mojom::NetworkContextParamsPtr context_params) {
+    feature_list_.InitWithFeatures(
+        {features::kOutOfBlinkCors, features::kNetworkService}, {});
+
     network_service_ = NetworkService::CreateForTesting();
 
     // Use a dummy CertVerifier that always passes cert verification, since
@@ -402,6 +406,9 @@ class CorsURLLoaderTest : public testing::Test {
   NetworkContext* network_context() { return network_context_.get(); }
 
  private:
+  // Testing instance to enable kOutOfBlinkCors feature.
+  base::test::ScopedFeatureList feature_list_;
+
   // Test environment.
   base::test::TaskEnvironment task_environment_;
   std::unique_ptr<net::URLRequestContext> url_request_context_;

services/network/network_context_unittest.cc

@@ -5558,7 +5558,12 @@ TEST_F(NetworkContextTest, HangingHeaderClientAbortDuringOnBeforeSendHeaders) {
 
   client.RunUntilComplete();
 
-  EXPECT_EQ(client.completion_status().error_code, net::ERR_ABORTED);
+  // The reported error differs, but eventually URLLoader returns
+  // net::ERR_ABORTED once OOR-CORS clean-up is finished.
+  if (features::ShouldEnableOutOfBlinkCorsForTesting())
+    EXPECT_EQ(client.completion_status().error_code, net::ERR_ABORTED);
+  else
+    EXPECT_EQ(client.completion_status().error_code, net::ERR_FAILED);
 }
 
 // Test destroying the mojom::URLLoader after the OnHeadersReceived event and
@@ -5606,7 +5611,12 @@ TEST_F(NetworkContextTest, HangingHeaderClientAbortDuringOnHeadersReceived) {
 
   client.RunUntilComplete();
 
-  EXPECT_EQ(client.completion_status().error_code, net::ERR_ABORTED);
+  // The reported error differs, but eventually URLLoader returns
+  // net::ERR_ABORTED once OOR-CORS clean-up is finished.
+  if (features::ShouldEnableOutOfBlinkCorsForTesting())
+    EXPECT_EQ(client.completion_status().error_code, net::ERR_ABORTED);
+  else
+    EXPECT_EQ(client.completion_status().error_code, net::ERR_FAILED);
 }
 
 // Custom proxy does not apply to localhost, so resolve kMockHost to localhost,

services/network/public/cpp/features.cc

@@ -26,8 +26,11 @@ const base::Feature kNetworkService {
       base::FEATURE_ENABLED_BY_DEFAULT
 };
 
-// FYI bots were just turned down, and we support only OOR-CORS enabled mode.
-// Legacy Blink CORS code will be removed quickly. (https://crbug.com/1053866)
+// Out of Blink CORS for browsers is launched at m79 (http://crbug.com/1001450),
+// and one for WebView will be at m81 (http://crbug.com/1035763).
+// The legacy CORS will be also maintained at least until m81 for enterprise
+// users. See https://sites.google.com/a/chromium.org/dev/Home/loading/oor-cors
+// for FYI Builders information.
 const base::Feature kOutOfBlinkCors{"OutOfBlinkCors",
                                     base::FEATURE_ENABLED_BY_DEFAULT};
 
@@ -244,6 +247,10 @@ const base::FeatureParam<TrustTokenOriginTrialSpec>
 const base::Feature kOutOfBlinkCSPEE{"OutOfBlinkCSPEE",
                                      base::FEATURE_DISABLED_BY_DEFAULT};
 
+bool ShouldEnableOutOfBlinkCorsForTesting() {
+  return base::FeatureList::IsEnabled(features::kOutOfBlinkCors);
+}
+
 const base::Feature kWebSocketReassembleShortMessages{
     "WebSocketReassembleShortMessages", base::FEATURE_ENABLED_BY_DEFAULT};
 

services/network/public/cpp/features.h

@@ -94,6 +94,9 @@ extern const base::FeatureParam<TrustTokenOriginTrialSpec>
 COMPONENT_EXPORT(NETWORK_CPP)
 extern const base::Feature kOutOfBlinkCSPEE;
 
+COMPONENT_EXPORT(NETWORK_CPP)
+bool ShouldEnableOutOfBlinkCorsForTesting();
+
 COMPONENT_EXPORT(NETWORK_CPP)
 extern const base::Feature kWebSocketReassembleShortMessages;