Serve mojo WebUI resources from the same origin as the WebUI itself.

content/renderer/web_ui_mojo_context_state.cc

Index: content/renderer/web_ui_mojo_context_state.cc
diff --git a/content/renderer/web_ui_mojo_context_state.cc b/content/renderer/web_ui_mojo_context_state.cc
index cb75e907e51eb1909b4554d47751f20fdf11a41e..a104e95beaf9726021b37cde7e5732f53caabe00 100644
--- a/content/renderer/web_ui_mojo_context_state.cc
+++ b/content/renderer/web_ui_mojo_context_state.cc
@@ -17,6 +17,7 @@
 #include "third_party/WebKit/public/platform/WebURLResponse.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
 #include "third_party/WebKit/public/web/WebScriptSource.h"
+#include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 
 using v8::Context;
 using v8::HandleScope;
@@ -29,10 +30,6 @@ namespace content {
 
 namespace {
 
-// All modules have this prefixed to them when downloading.
-// TODO(sky): move this into some common place.
-const char kModulePrefix[] = "chrome://mojo/";
-
 void RunMain(base::WeakPtr<gin::Runner> runner,
              v8::Local<v8::Value> module) {
   v8::Isolate* isolate = runner->GetContextHolder()->isolate();
@@ -89,7 +86,7 @@ void WebUIMojoContextState::FetchModules(const std::vector<std::string>& ids) {
 }
 
 void WebUIMojoContextState::FetchModule(const std::string& id) {
-  const GURL url(kModulePrefix + id);
+  const GURL url(GetModulePrefix() + id);
   // TODO(sky): better error checks here?
   DCHECK(url.is_valid() && !url.is_empty());
   DCHECK(fetched_modules_.find(id) == fetched_modules_.end());
@@ -109,10 +106,10 @@ void WebUIMojoContextState::OnFetchModuleComplete(
     ResourceFetcher* fetcher,
     const blink::WebURLResponse& response,
     const std::string& data) {
-  DCHECK_EQ(kModulePrefix,
-      response.url().string().utf8().substr(0, arraysize(kModulePrefix) - 1));
+  DCHECK_EQ(GetModulePrefix(),
+            response.url().string().utf8().substr(0, GetModulePrefix().size()));
   const std::string module =
-      response.url().string().utf8().substr(arraysize(kModulePrefix) - 1);
+      response.url().string().utf8().substr(GetModulePrefix().size());
   // We can't delete fetch right now as the arguments to this function come from
   // it and are used below. Instead use a scope_ptr to cleanup.
   scoped_ptr<ResourceFetcher> deleter(fetcher);
@@ -137,4 +134,10 @@ void WebUIMojoContextState::OnDidAddPendingModule(
   registry->AttemptToLoadMoreModules(context_holder->isolate());
 }
 
+const std::string& WebUIMojoContextState::GetModulePrefix() {
+  if (module_prefix_.empty())

[sky, 2015/11/19 17:43:38]

Can module_prefix_ be set correctly in the constructor?

[Sam McNally, 2015/11/22 23:43:30]

Done.

+    module_prefix_ = frame_->securityOrigin().toString().utf8() + "/";
+  return module_prefix_;
+}
+
 }  // namespace content