Do not copy reference fragments for overridden redirects.

net/url_request/url_request_job.cc

Index: net/url_request/url_request_job.cc
diff --git a/net/url_request/url_request_job.cc b/net/url_request/url_request_job.cc
index 35dbbb1d16c6cbac47105b613c8fda3206b44dcf..f83dec3010ca8c20440a7927e571b969e3e57b81 100644
--- a/net/url_request/url_request_job.cc
+++ b/net/url_request/url_request_job.cc
@@ -158,6 +158,11 @@ bool URLRequestJob::IsRedirectResponse(GURL* location,
   return true;
 }
 
+bool URLRequestJob::IsRedirectFragmentModificationAllowed(
+    const GURL& location) {
+  return true;
+}
+
 bool URLRequestJob::IsSafeRedirect(const GURL& location) {
   return true;
 }
@@ -335,7 +340,8 @@ void URLRequestJob::NotifyHeadersComplete() {
 
     // Move the reference fragment of the old location to the new one if the
     // new one has none. This duplicates mozilla's behavior.
-    if (url.is_valid() && url.has_ref() && !new_location.has_ref()) {
+    if (url.is_valid() && url.has_ref() && !new_location.has_ref() &&
+        IsRedirectFragmentModificationAllowed(new_location)) {
       GURL::Replacements replacements;
       // Reference the |ref| directly out of the original URL to avoid a
       // malloc.