[Loader] Add asserts about revalidation and redirects

third_party/WebKit/Source/core/fetch/Resource.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
     Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 528 matching lines @@
 
 const ResourceRequest& Resource::lastResourceRequest() const
 {
     if (!m_redirectChain.size())
         return m_resourceRequest;
     return m_redirectChain.last().m_request;
 }
 
 void Resource::setRevalidatingRequest(const ResourceRequest& request)
 {
+    SECURITY_CHECK(m_redirectChain.isEmpty());
     m_revalidatingRequest = request;
     m_status = NotStarted;
 }
 
 void Resource::willFollowRedirect(ResourceRequest& newRequest, const ResourceResponse& redirectResponse)
 {
     if (!m_revalidatingRequest.isNull())
         revalidationFailed();
 
     newRequest.setAllowStoredCredentials(m_options.allowCredentials == AllowStoredCredentials);
@@ skipping 334 matching lines @@
     memoryDump->addSuballocation(overheadDump->guid(), String(WTF::Partitions::kAllocatedObjectPoolName));
 }
 
 String Resource::getMemoryDumpName() const
 {
     return String::format("web_cache/%s_resources/%ld", resourceTypeToString(getType(), options().initiatorInfo), m_identifier);
 }
 
 void Resource::revalidationSucceeded(const ResourceResponse& validatingResponse)
 {
+    SECURITY_CHECK(m_redirectChain.isEmpty());
+    SECURITY_CHECK(validatingResponse.url() == m_response.url());
     m_response.setResourceLoadTiming(validatingResponse.resourceLoadTiming());
 
     // RFC2616 10.3.5
     // Update cached headers from the 304 response
     const HTTPHeaderMap& newHeaders = validatingResponse.httpHeaderFields();
     for (const auto& header : newHeaders) {
         // Entity headers should not be sent by servers when generating a 304
         // response; misconfigured servers send them anyway. We shouldn't allow
         // such headers to update the original request. We'll base this on the
         // list defined by RFC2616 7.1, with a few additions for extension headers
         // we care about.
         if (!shouldUpdateHeaderAfterRevalidation(header.key))
             continue;
         m_response.setHTTPHeaderField(header.key, header.value);
     }
 
     m_resourceRequest = m_revalidatingRequest;
     m_revalidatingRequest = ResourceRequest();
 }
 
 void Resource::revalidationFailed()
 {
     m_resourceRequest = m_revalidatingRequest;
     m_revalidatingRequest = ResourceRequest();
-    m_redirectChain.clear();
+    SECURITY_CHECK(m_redirectChain.isEmpty());
     m_data.clear();
     m_cacheHandler.clear();
     destroyDecodedDataForFailedRevalidation();
 }
 
 bool Resource::canReuseRedirectChain()
 {
     for (auto& redirect : m_redirectChain) {
         if (!canUseResponse(redirect.m_redirectResponse, m_responseTimestamp))
             return false;
@@ skipping 192 matching lines @@
     case Resource::Media:
         return "Media";
     case Resource::Manifest:
         return "Manifest";
     }
     ASSERT_NOT_REACHED();
     return "Unknown";
 }
 
 } // namespace blink