Fix referrer policy passing during redirects

content/renderer/render_view_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view_impl.h"
 
 #include <algorithm>
 #include <cmath>
 
 #include "base/auto_reset.h"
@@ skipping 1945 matching lines @@
     }
 
     // If the page contained a client redirect (meta refresh, document.loc...),
     // set the referrer and transition appropriately.
     if (ds->isClientRedirect()) {
       params.referrer = Referrer(params.redirects[0],
           GetReferrerPolicyFromRequest(frame, ds->request()));
       params.transition = static_cast<PageTransition>(
           params.transition | PAGE_TRANSITION_CLIENT_REDIRECT);
     } else {
-      // Bug 654101: the referrer will be empty on https->http transitions. It
-      // would be nice if we could get the real referrer from somewhere.
-      params.referrer = GetReferrerFromRequest(frame, original_request);
+      params.referrer = GetReferrerFromRequest(frame, ds->request());
     }
 
     base::string16 method = request.httpMethod();
     if (EqualsASCII(method, "POST")) {
       params.is_post = true;
       params.post_id = ExtractPostId(item);
     }
 
     // Send the user agent override back.
     params.is_overriding_user_agent = internal_data->is_overriding_user_agent();
@@ skipping 1601 matching lines @@
       InternalDocumentStateData::FromDocumentState(document_state);
 
   if (document_state->commit_load_time().is_null())
     document_state->set_commit_load_time(Time::Now());
 
   if (internal_data->must_reset_scroll_and_scale_state()) {
     webview()->resetScrollAndScaleState();
     internal_data->set_must_reset_scroll_and_scale_state(false);
   }
   internal_data->set_use_error_page(false);
+  internal_data->clear_referrer_policy();
 
   if (is_new_navigation) {
     // When we perform a new navigation, we need to update the last committed
     // session history entry with state for the page we are leaving.
     UpdateSessionHistory(frame);
 
     // We bump our Page ID to correspond with the new session history entry.
     page_id_ = next_page_id_++;
 
     // Don't update history_page_ids_ (etc) for kSwappedOutURL, since
@@ skipping 2784 matching lines @@
   for (size_t i = 0; i < icon_urls.size(); i++) {
     WebURL url = icon_urls[i].iconURL();
     if (!url.isEmpty())
       urls.push_back(FaviconURL(url,
                                 ToFaviconType(icon_urls[i].iconType())));
   }
   SendUpdateFaviconURL(urls);
 }
 
 }  // namespace content