To implement WebView::loadDataWithBaseURL() correctly, documentLoader needs to take a baseUrl as a loading option.

See WebView::loadDataWithBaseURL() document.
https://developer.android.com/reference/android/webkit/WebView.html#loadDataWithBaseURL(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang.String)

> void loadDataWithBaseURL (String baseUrl, String data, String mimeType, String encoding, String historyUrl)
> Loads the given data into this WebView, using baseUrl as the base URL for the content. The base URL is used both to resolve relative URLs and when applying JavaScript's same origin policy.
> Note that content specified in this way can access local device files (via 'file' scheme URLs) only if baseUrl specifies a scheme other than 'http', 'https', 'ftp', 'ftps', 'about' or 'javascript'.
> If the base URL uses the data scheme, this method is equivalent to calling loadData() and the historyUrl is ignored, and the data will be treated as part of a data: URL. If the base URL uses any other scheme, then the data will be loaded into the WebView as a plain string (i.e. not part of a data URL) and any URL-encoded entities in the string will not be decoded.
> Note that the baseUrl is sent in the 'Referer' HTTP header when requesting subresources (images, etc.) of the page loaded using this method.

The document does not explain what the page URL should be, but I assume it should be an encoded data in the data URL format.

But, the last note that the baseUrl is sent in the 'Referer' HTTP header seems to imply the baseUrl pretends the page URL.

Actually, current implementation sets the baseUrl to the page URL, and I guess the last note just says how this is implemented.

See also  crbug.com/662823  and crrev.com/2531013002.