Relax cross-origin partial response requirements for CORS presence.

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 142 matching lines @@
         // |this| may be dead here.
         return;
     }
 
     m_requestStartedSeconds = monotonicallyIncreasingTime();
 
     // Save any CORS simple headers on the request here. If this request redirects cross-origin, we cancel the old request
     // create a new one, and copy these headers.
     const HTTPHeaderMap& headerMap = request.httpHeaderFields();
     for (const auto& header : headerMap) {
-        if (FetchUtils::isSimpleHeader(header.key, header.value))
+        if (FetchUtils::isSimpleHeader(header.key, header.value)) {
             m_simpleRequestHeaders.add(header.key, header.value);
+        } else if (equalIgnoringCase(header.key, "range") && m_options.crossOriginRequestPolicy == UseAccessControl && m_options.preflightPolicy == PreventPreflight) {
+            // Allow an exception for the "range" header for when CORS callers request no preflight, this ensures cross-origin
+            // redirects work correctly for crossOrigin enabled WebURLRequest::RequestContextVideo type requests.
+            m_simpleRequestHeaders.add(header.key, header.value);
+        }
     }
 
     // DocumentThreadableLoader is used by all javascript initiated fetch, so
     // we use this chance to record non-GET fetch script requests.
     // However, this is based on the following assumptions, so please be careful
     // when adding similar logic:
     // - ThreadableLoader is used as backend for all javascript initiated network
     //   fetches.
     //   - Note that ThreadableLoader is also used for non-network fetch such as
     //     FileReaderLoader. However it emulates GET method so signal is not
@@ skipping 690 matching lines @@
         return DoNotAllowStoredCredentials;
     return m_resourceLoaderOptions.allowCredentials;
 }
 
 SecurityOrigin* DocumentThreadableLoader::securityOrigin() const
 {
     return m_securityOrigin ? m_securityOrigin.get() : m_document.securityOrigin();
 }
 
 } // namespace blink