Cross origin requests to same origin should match

third_party/WebKit/Source/core/loader/TextTrackLoader.cpp

 /*
  * Copyright (C) 2011 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 91 matching lines @@
 
     cancelLoad();
 }
 
 bool TextTrackLoader::load(const KURL& url, CrossOriginAttributeValue crossOrigin)
 {
     cancelLoad();
 
     FetchRequest cueRequest(ResourceRequest(document().completeURL(url)), FetchInitiatorTypeNames::texttrack);
 
-    if (crossOrigin != CrossOriginAttributeNotSet) {
-        cueRequest.setCrossOriginAccessControl(document().getSecurityOrigin(), crossOrigin);
-    } else if (!document().getSecurityOrigin()->canRequestNoSuborigin(url)) {
+    if (crossOrigin == CrossOriginAttributeNotSet && !document().getSecurityOrigin()->canRequestNoSuborigin(url)) {
         // Text track elements without 'crossorigin' set on the parent are "No CORS"; report error if not same-origin.
         corsPolicyPreventedLoad(document().getSecurityOrigin(), url);
         return false;
     }
+    cueRequest.setCrossOriginAccessControl(document().getSecurityOrigin(), crossOrigin);
 
     ResourceFetcher* fetcher = document().fetcher();
     setResource(RawResource::fetchTextTrack(cueRequest, fetcher));
     return resource();
 }
 
 void TextTrackLoader::newCuesParsed()
 {
     if (m_cueLoadTimer.isActive())
         return;
@@ skipping 34 matching lines @@
 }
 
 DEFINE_TRACE(TextTrackLoader)
 {
     visitor->trace(m_cueParser);
     visitor->trace(m_document);
     ResourceOwner<RawResource>::trace(visitor);
 }
 
 } // namespace blink