The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d6242200d470ce49aae51175a1e7963dbf21a7d0

commit d6242200d470ce49aae51175a1e7963dbf21a7d0
Author: Vasilii Sukhanov <vasilii@chromium.org>
Date: Wed Jun 13 15:38:49 2018

Fix the format of signon_realm when migrating a credential HTTP -> HTTPS.

HttpPasswordStoreMigrator copies/moves http saved credentials to https. However, the format of the signon_realm was wrong. It should not contain the whole URL path. That is, instead of "https://google.com/something/" it should save "https://google.com/".

Bug: 852356
Change-Id: I25999f938a5ace9378c3ec0fb614491e28a71e88
Reviewed-on: https://chromium-review.googlesource.com/1098967
Reviewed-by: Vaclav Brozek <vabr@chromium.org>
Commit-Queue: Vasilii Sukhanov <vasilii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#566842}
[modify] https://crrev.com/d6242200d470ce49aae51175a1e7963dbf21a7d0/components/password_manager/core/browser/http_password_store_migrator.cc
[modify] https://crrev.com/d6242200d470ce49aae51175a1e7963dbf21a7d0/components/password_manager/core/browser/http_password_store_migrator_unittest.cc

I want to merge r566842 back to M68. The fix is simple but the impact is big. Chrome can load 100% CPU under some common conditions.

This bug requires manual review: M68 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), kariahda@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Is this well tested in canary?

Already yes.

Approving merge to M68. Branch:3440

Pls merge you change to M68 branch 3440 ASAP so we can pick it up for this week Beta release. Merge has to happen latest by 1:00 PM PT tomorrow, Tuesday (06/19), so we can pick it up for Wednesday Beta release.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d68de7f8c5937d04bdb3c77c85bcba441b6e137d

commit d68de7f8c5937d04bdb3c77c85bcba441b6e137d
Author: Vasilii Sukhanov <vasilii@chromium.org>
Date: Tue Jun 19 08:54:34 2018

Fix the format of signon_realm when migrating a credential HTTP -> HTTPS.

HttpPasswordStoreMigrator copies/moves http saved credentials to https. However, the format of the signon_realm was wrong. It should not contain the whole URL path. That is, instead of "https://google.com/something/" it should save "https://google.com/".

TBR=vasilii@chromium.org

(cherry picked from commit d6242200d470ce49aae51175a1e7963dbf21a7d0)

Bug: 852356
Change-Id: I25999f938a5ace9378c3ec0fb614491e28a71e88
Reviewed-on: https://chromium-review.googlesource.com/1098967
Reviewed-by: Vaclav Brozek <vabr@chromium.org>
Commit-Queue: Vasilii Sukhanov <vasilii@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#566842}
Reviewed-on: https://chromium-review.googlesource.com/1105765
Reviewed-by: Vasilii Sukhanov <vasilii@chromium.org>
Cr-Commit-Position: refs/branch-heads/3440@{#441}
Cr-Branched-From: 010ddcfda246975d194964ccf20038ebbdec6084-refs/heads/master@{#561733}
[modify] https://crrev.com/d68de7f8c5937d04bdb3c77c85bcba441b6e137d/components/password_manager/core/browser/http_password_store_migrator.cc
[modify] https://crrev.com/d68de7f8c5937d04bdb3c77c85bcba441b6e137d/components/password_manager/core/browser/http_password_store_migrator_unittest.cc

Fixing signon_realm is working only for HTML credentials.

Let’s assume that the user has in Password Store only one form. The form origin is “http://httpbin.org/" and signon_realm is http://httpbin.org/". It can be a PasswordForm::scheme HTML or non-HTML with empty realm. Then:

1. User visit a website that has an HTTP auth form. Suppose the website is https://httpbin.org/something. The form created have origin = “https://httpbin.org/something" . Let’s suppose that auth realm is “realm”, so the  signon_realm will be “https://httpbin.org/realm”.
2. FormFetcherImpl requests credentials for https.
3. None are returned. HttpPasswordStoreMigrator is created to process the http credentials.
   It request credentials for
       PasswordForm::scheme = HTML,
       origin = “http://httpbin.org/something”,
       signon_realm = “http://httpbin.org/”.

   However, signon_realm should be “http://httpbin.org/realm”.

4. Credentials are found and they are copied (HSTS not enabled). New credentials have : 
   origin = “https://httpbin.org/something" 
   signon_realm = “https://httpbin.org/”,
   PasswordForm::scheme  the same as http credentials.

5. If http credentials from Password Store is HTML then https credentials doesn’t match because of different PasswordForm::scheme (PasswordFormManager::IsMatch).
   Even if the http credentials from Password Store has SCHEME_BASIC (the same as submitted form), the migrated https credentials doesn’t match because of different signon_realm (LoginModelObserver::OnAutofillDataAvailable):
   current signon_realm = “https://httpbin.org/realm”
   migrated HTTPS form has signon_realm = “https://httpbin.org/”. 

6. User visit https://httpbin.org/something again, steps 2-5 repeat.

Moreover, if password manager state is not inactive (ManagePasswordsState::ProcessLoginsChanged), infinite password store requests reported is not solved for the scenario described above.

In order not to migrate wrong credentials, FormFetcherImpl should create HttpPasswordStoreMigrator only if form is HTML.