Update from https://crrev.com/316786

List of manually-modified files:
gpu/command_buffer/service/in_process_command_buffer.cc
examples/sample_app/BUILD.gn
examples/sample_app/spinning_cube.cc
mojo/android/javatests/src/org/chromium/mojo/MojoTestCase.java
mojo/cc/context_provider_mojo.cc
mojo/cc/context_provider_mojo.h
mojo/common/trace_controller_impl.cc
mojo/gles2/command_buffer_client_impl.cc
mojo/gles2/command_buffer_client_impl.h
services/gles2/gpu_impl.cc
shell/android/apk/src/org/chromium/mojo/shell/MojoShellApplication.java
sky/engine/core/dom/Node.cpp
sky/shell/apk/src/org/domokit/sky/shell/SkyShellApplication.java
ui/events/latency_info.cc
ui/gfx/transform.cc
ui/gfx/transform.h
ui/gfx/transform_util.cc
ui/gfx/transform_util.h

Review URL: https://codereview.chromium.org/935333002

url_canon_relative.cc

diff --git a/url_canon_relative.cc b/url_canon_relative.cc
index 9436245..06ca99c 100644
--- a/url_canon_relative.cc
+++ b/url_canon_relative.cc
@@ -170,8 +170,8 @@
 // up until and including the last slash. There should be a slash in the
 // range, if not, nothing will be copied.
 //
-// The input is assumed to be canonical, so we search only for exact slashes
-// and not backslashes as well. We also know that it's ASCII.
+// For stardard URLs the input should be canonical, but when resolving relative
+// URLs on a non-standard base (like "data:") the input can be anything.
 void CopyToLastSlash(const char* spec,
                      int begin,
                      int end,
@@ -179,7 +179,7 @@
   // Find the last slash.
   int last_slash = -1;
   for (int i = end - 1; i >= begin; i--) {
-    if (spec[i] == '/') {
+    if (spec[i] == '/' || spec[i] == '\\') {
       last_slash = i;
       break;
     }

url_util_unittest.cc

diff --git a/url_util_unittest.cc b/url_util_unittest.cc
index 17c1b0f..73ff93b 100644
--- a/url_util_unittest.cc
+++ b/url_util_unittest.cc
@@ -273,6 +273,15 @@
       // any URL scheme is we might break javascript: URLs by doing so...
     {"javascript:alert('foo#bar')", "#badfrag", true,
       "javascript:alert('foo#badfrag" },
+      // In this case, the backslashes will not be canonicalized because it's a
+      // non-standard URL, but they will be treated as a path separators,
+      // giving the base URL here a path of "\".
+      //
+      // The result here is somewhat arbitrary. One could argue it should be
+      // either "aaa://a\" or "aaa://a/" since the path is being replaced with
+      // the "current directory". But in the context of resolving on data URLs,
+      // adding the requested dot doesn't seem wrong either.
+    {"aaa://a\\", "aaa:.", true, "aaa://a\\." }
   };
 
   for (size_t i = 0; i < arraysize(resolve_non_standard_cases); i++) {