We should go through all of chrome://chrome-urls/ (though note that that page contains some dead links)

Especially helpful will be the debug pages, to test things like renderer crashes, gpu crashes, etc.

9. chrome://crash/
10. All chrome:// URLs (see chrome://chrome-urls/).

11. chrome-native://recent-tabs/ from  issue 696566 

12. Find or create a page similar to #6 that exercises all form and other input elements. (See https://developer.mozilla.org/en-US/docs/Learn/HTML/Forms/The_native_form_widgets.)

13. Mixed content warnings (a sampling of potential test sites):
a. https://mixed-content-test.appspot.com/
b. https://www.bennish.net/mixed-content.html
c. https://people-mozilla.org/~mkelly/mixed_test.html

14. https://badssl.com/

For badssl.com, note that this page has a large set of individual test pages.  We'd like to verify that Clank and VR's URL bars display them in an equivalent way.

Some cases need special consideration:
- Long hostnames should cause VR to bail out (we can't yet elide)
- It's okay for us to show the (i) icon, even if clank hides it

Would also be good to check IDNs. There's a handy collection of non-ascii URLs listed here: http://www.personal.psu.edu/ejp10/blogs/gotunicode/2011/02/non-ascii-urls-to-test.html

We should check that they render correctly.

15. Comment 10.

What is the expected behavior at point 13 (Mixed content warnings)? There are no  warnings for mixed content neither in 2D Clank nor in the ChromeVR, mixed active content is just silently blocked.

Grey https, I think.

Is the intent of this bug to capture the need for an ongoing testing regimen, or are we saying that we want to ensure that UI security issues are well in hand?

If it's the latter, could we log bugs for each issue? We can then mark them verified as they're fixed.

I covered all 15 items in this issue with manual test cases and was going to mark it as fixed.

I think this bug is used to cover all the concerns from UX review for Chrome VR first launch, the url list in comment #1 are from ainslie@ in UX review.

I think most of urls can be handled pretty well in Chrome VR, do you want us to only log bugs for the urls which we can not handle them as expected? Or do you prefer to log one bug for one url category, even they work well now?

All items are covered with manual test cases. 

Issues were found during testing:
 issue 737826 	Some features rejected in VR cannot be used after exiting VR
 issue 728421 	Storage request is suppressed but not declined in Chrome VR
issue 728274	"Storage access" permission popup isn't disabled in Chrome VR
issue 727955	Chrome crashes if to click into "Email address" input field when in Chrome VR
 issue 733410 	Cast device dialog is not disabled in Chrome VR
 issue 730850 	"USB" permission popup isn't disabled in Chrome VR
 issue 729664 	VR NTP page: Clicking 'More' under the recent bookmarks section triggers exiting VR