fix service worker cross-origin problem in multibuffers

media/blink/resource_multibuffer_data_provider.cc

Index: media/blink/resource_multibuffer_data_provider.cc
diff --git a/media/blink/resource_multibuffer_data_provider.cc b/media/blink/resource_multibuffer_data_provider.cc
index 0acae612b9d2deeaacd1920a965d609ac91a74d8..fd408ab60f9645c9a5fc35c0acadfdb450eded97 100644
--- a/media/blink/resource_multibuffer_data_provider.cc
+++ b/media/blink/resource_multibuffer_data_provider.cc
@@ -164,7 +164,9 @@ void ResourceMultiBufferDataProvider::willFollowRedirect(
       if (url_data_->multibuffer()->map().empty() && fifo_.empty())
         return;
 
+      active_loader_ = nullptr;
       url_data_->Fail();
+      return;  // "this" may be deleted now.
     }
   }
 }
@@ -278,8 +280,9 @@ void ResourceMultiBufferDataProvider::didReceiveResponse(
       destination_url_data->multibuffer()->OnDataProviderEvent(this);
       return;
     } else {
+      active_loader_ = nullptr;
       destination_url_data->Fail();
-      return;
+      return;  // "this" may be deleted now.
     }
   } else {
     destination_url_data->set_range_supported();
@@ -312,6 +315,16 @@ void ResourceMultiBufferDataProvider::didReceiveResponse(
     // cause clients to start using the new UrlData.
     old_url_data->RedirectTo(destination_url_data);
   }
+
+  // This test is vital for security!
+  const GURL& original_url = response.wasFetchedViaServiceWorker()
+                                 ? response.originalURLViaServiceWorker()
+                                 : response.url();
+  if (!url_data_->ValidateDataOrigin(original_url.GetOrigin())) {
+    active_loader_ = nullptr;
+    url_data_->Fail();
+    return;  // "this" may be deleted now.
+  }
 }
 
 void ResourceMultiBufferDataProvider::didReceiveData(WebURLLoader* loader,
@@ -388,9 +401,9 @@ void ResourceMultiBufferDataProvider::didFinishLoading(
           base::TimeDelta::FromMilliseconds(kLoaderPartialRetryDelayMs));
       return;
     } else {
-      std::unique_ptr<ActiveLoader> active_loader = std::move(active_loader_);
+      active_loader_ = nullptr;
       url_data_->Fail();
-      return;
+      return;  // "this" may be deleted now.
     }
   }