Bypass ServiceWorker when the request originates from isolated world.

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 164 matching lines @@
     //     recorded here.
     // - ThreadableLoader w/ non-GET request is only created from javascript
     //   initiated fetch.
     //   - Some non-script initiated fetches such as WorkerScriptLoader also use
     //     ThreadableLoader, but they are guaranteed to use GET method.
     if (request.httpMethod() != "GET") {
         if (Page* page = m_document.page())
             page->chromeClient().didObserveNonGetFetchFromScript();
     }
 
+    if (!document.securityOrigin()->isSameSchemeHostPort(securityOrigin())) {

[hiroshige, 2015/10/15 08:30:02]

nit: Using |m_document| instead of |document| might be better.
|document| is only used for setting |m_document| and other code in
DocumentThreadableLoader uses |m_document|.

[hiroshige, 2015/10/15 08:30:02]

Just for memo:
This condition is also true for file:// origin, but I expect this is OK.

+        ResourceRequest newRequest(request);
+        newRequest.setSkipServiceWorker(true);
+        dispatchInitialRequest(newRequest);
+        // |this| may be dead here in async mode.
+        return;
+    }
+
     // If the fetch request will be handled by the ServiceWorker, the
     // FetchRequestMode of the request must be FetchRequestModeCORS or
     // FetchRequestModeCORSWithForcedPreflight. Otherwise the ServiceWorker can
     // return a opaque response which is from the other origin site and the
     // script in the page can read the content.
     //
     // We assume that ServiceWorker is skipped for sync requests and non-HTTP
     // familiy requests by content/ code.
     if (m_async && !request.skipServiceWorker() && request.url().protocolIsInHTTPFamily() && m_document.fetcher()->isControlledByServiceWorker()) {
         ResourceRequest newRequest(request);
@@ skipping 670 matching lines @@
         return DoNotAllowStoredCredentials;
     return m_resourceLoaderOptions.allowCredentials;
 }
 
 SecurityOrigin* DocumentThreadableLoader::securityOrigin() const
 {
     return m_securityOrigin ? m_securityOrigin.get() : m_document.securityOrigin();
 }
 
 } // namespace blink