Set the request mode and the credentials mode even if the request will not go to ServiceWorker.

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 75 matching lines @@
         WeakPtrFactory<EmptyDataReader> m_factory;
     };
 
     Reader* obtainReaderInternal(Client* client) override
     {
         return new EmptyDataReader(client);
     }
     const char* debugName() const override { return "EmptyDataHandle"; }
 };
 
+// No-CORS requests are allowed for all these contexts, and plugin contexts with
+// private permission when we set skipServiceWorker flag in PepperURLLoaderHost.
+bool IsNoCORSAllowedContext(WebURLRequest::RequestContext context, bool skipServiceWorker)
+{
+    switch (context) {
+    case WebURLRequest::RequestContextAudio:
+    case WebURLRequest::RequestContextVideo:
+    case WebURLRequest::RequestContextObject:
+    case WebURLRequest::RequestContextFavicon:
+    case WebURLRequest::RequestContextImage:
+    case WebURLRequest::RequestContextScript:
+        return true;
+    case WebURLRequest::RequestContextPlugin:
+        return skipServiceWorker;
+    default:
+        return false;
+    }
+}
+
 } // namespace
 
 // Max number of CORS redirects handled in DocumentThreadableLoader.
 // Same number as net/url_request/url_request.cc, and
 // same number as https://fetch.spec.whatwg.org/#concept-http-fetch, Step 4.
 // FIXME: currently the number of redirects is counted and limited here and in
 // net/url_request/url_request.cc separately.
 static const int kMaxCORSRedirects = 20;
 
 void DocumentThreadableLoader::loadResourceSynchronously(Document& document, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
@@ skipping 73 matching lines @@
     //     recorded here.
     // - ThreadableLoader w/ non-GET request is only created from javascript
     //   initiated fetch.
     //   - Some non-script initiated fetches such as WorkerScriptLoader also use
     //     ThreadableLoader, but they are guaranteed to use GET method.
     if (request.httpMethod() != HTTPNames::GET) {
         if (Page* page = m_document->page())
             page->chromeClient().didObserveNonGetFetchFromScript();
     }
 
+    ResourceRequest newRequest(request);
+    if (m_requestContext != WebURLRequest::RequestContextFetch) {
+        // When the request context is not "fetch",
+        // |crossOriginRequestPolicy| represents the fetch request mode,
+        // and |credentialsRequested| represents the fetch credentials mode.
+        // So we set those flags here so that we can see the correct request
+        // mode and credentials mode in the service worker's fetch event
+        // handler.
+        switch (m_options.crossOriginRequestPolicy) {
+        case DenyCrossOriginRequests:
+            newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeSameOrigin);
+            break;
+        case UseAccessControl:
+            if (m_options.preflightPolicy == ForcePreflight)
+                newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeCORSWithForcedPreflight);
+            else
+                newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeCORS);
+            break;
+        case AllowCrossOriginRequests:
+            SECURITY_CHECK(IsNoCORSAllowedContext(m_requestContext, request.skipServiceWorker()));
+            newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeNoCORS);
+            break;
+        }
+        if (m_resourceLoaderOptions.allowCredentials == AllowStoredCredentials)
+            newRequest.setFetchCredentialsMode(WebURLRequest::FetchCredentialsModeInclude);
+        else
+            newRequest.setFetchCredentialsMode(WebURLRequest::FetchCredentialsModeSameOrigin);
+    }
+
     // We assume that ServiceWorker is skipped for sync requests and unsupported
     // protocol requests by content/ code.
     if (m_async && !request.skipServiceWorker() && SchemeRegistry::shouldTreatURLSchemeAsAllowingServiceWorkers(request.url().protocol()) && m_document->fetcher()->isControlledByServiceWorker()) {
-        ResourceRequest newRequest(request);
-        const WebURLRequest::RequestContext requestContext(request.requestContext());
-        if (requestContext != WebURLRequest::RequestContextFetch) {
-            // When the request context is not "fetch",
-            // |crossOriginRequestPolicy| represents the fetch request mode,
-            // and |credentialsRequested| represents the fetch credentials mode.
-            // So we set those flags here so that we can see the correct request
-            // mode and credentials mode in the service worker's fetch event
-            // handler.
-            switch (m_options.crossOriginRequestPolicy) {
-            case DenyCrossOriginRequests:
-                newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeSameOrigin);
-                break;
-            case UseAccessControl:
-                if (m_options.preflightPolicy == ForcePreflight)
-                    newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeCORSWithForcedPreflight);
-                else
-                    newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeCORS);
-                break;
-            case AllowCrossOriginRequests:
-                // No-CORS requests are allowed only for those contexts.
-                SECURITY_CHECK(requestContext == WebURLRequest::RequestContextAudio || requestContext == WebURLRequest::RequestContextVideo || requestContext == WebURLRequest::RequestContextObject || requestContext == WebURLRequest::RequestContextFavicon || requestContext == WebURLRequest::RequestContextImage || requestContext == WebURLRequest::RequestContextScript);
-                newRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeNoCORS);
-                break;
-            }
-            if (m_resourceLoaderOptions.allowCredentials == AllowStoredCredentials)
-                newRequest.setFetchCredentialsMode(WebURLRequest::FetchCredentialsModeInclude);
-            else
-                newRequest.setFetchCredentialsMode(WebURLRequest::FetchCredentialsModeSameOrigin);
-        }
         if (newRequest.fetchRequestMode() == WebURLRequest::FetchRequestModeCORS || newRequest.fetchRequestMode() == WebURLRequest::FetchRequestModeCORSWithForcedPreflight) {
             m_fallbackRequestForServiceWorker = ResourceRequest(request);
             m_fallbackRequestForServiceWorker.setSkipServiceWorker(true);
         }
-
         loadRequest(newRequest, m_resourceLoaderOptions);
         // |this| may be dead here.
         return;
     }
 
-    dispatchInitialRequest(request);
+    dispatchInitialRequest(newRequest);
     // |this| may be dead here in async mode.
 }
 
 void DocumentThreadableLoader::dispatchInitialRequest(const ResourceRequest& request)
 {
     if (!request.isExternalRequest() && (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests)) {
         loadRequest(request, m_resourceLoaderOptions);
         // |this| may be dead here in async mode.
         return;
     }
@@ skipping 731 matching lines @@
     return m_securityOrigin ? m_securityOrigin.get() : document().getSecurityOrigin();
 }
 
 Document& DocumentThreadableLoader::document() const
 {
     ASSERT(m_document);
     return *m_document;
 }
 
 } // namespace blink