Correctly handle CORS access checks over cache-validating responses.

Source/core/fetch/ResourceLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2010, 2011 Apple Inc. All rights reserved.
  *           (C) 2007 Graham Dennis (graham.dennis@gmail.com)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 295 matching lines @@
 
     bool isMultipartPayload = response.isMultipartPayload();
     bool isValidStateTransition = (m_connectionState == ConnectionStateStarted || m_connectionState == ConnectionStateReceivedResponse);
     // In the case of multipart loads, calls to didReceiveData & didReceiveResponse can be interleaved.
     RELEASE_ASSERT(isMultipartPayload || isValidStateTransition);
     m_connectionState = ConnectionStateReceivedResponse;
 
     const ResourceResponse& resourceResponse = response.toResourceResponse();
 
     if (responseNeedsAccessControlCheck()) {
-        m_resource->setResponse(resourceResponse);
-        if (!m_host->canAccessResource(m_resource, response.url())) {
+        // If the response successfully validated a cached resource, perform
+        // the access control with respect to it. Need to do this right here
+        // before the resource switches clients over to that validated resource.
+        Resource* resource = m_resource;
+        if (resource->isCacheValidator() && resourceResponse.httpStatusCode() == 304)
+            resource = m_resource->resourceToRevalidate();
+        else
+            m_resource->setResponse(resourceResponse);
+        if (!m_host->canAccessResource(resource, response.url())) {
             cancel();
             return;
         }
     }
 
     // Reference the object in this method since the additional processing can do
     // anything including removing the last reference to this object.
     RefPtr<ResourceLoader> protect(this);
     m_resource->responseReceived(resourceResponse);
     if (m_state == Terminated)
@@ skipping 121 matching lines @@
     didReceiveResponse(0, responseOut);
     if (m_state == Terminated)
         return;
     RefPtr<ResourceLoadInfo> resourceLoadInfo = responseOut.toResourceResponse().resourceLoadInfo();
     m_host->didReceiveData(m_resource, dataOut.data(), dataOut.size(), resourceLoadInfo ? resourceLoadInfo->encodedDataLength : -1);
     m_resource->setResourceBuffer(dataOut);
     didFinishLoading(0, monotonicallyIncreasingTime());
 }
 
 }