Do not copy reference fragments for overridden redirects.

net/base/network_delegate.h

Index: net/base/network_delegate.h
diff --git a/net/base/network_delegate.h b/net/base/network_delegate.h
index 4f930cf6b7b3c842d233bec7e0e272334e1c840e..4be320b9305ccd869a76239eeb25834aa5d8a83d 100644
--- a/net/base/network_delegate.h
+++ b/net/base/network_delegate.h
@@ -102,12 +102,15 @@ class NET_EXPORT NetworkDelegate : public base::NonThreadSafe {
   // member function, which will perform basic sanity checking.
 
   // Called before a request is sent. Allows the delegate to rewrite the URL
-  // being fetched by modifying |new_url|. |callback| and |new_url| are valid
-  // only until OnURLRequestDestroyed is called for this request. Returns a net
-  // status code, generally either OK to continue with the request or
-  // ERR_IO_PENDING if the result is not ready yet. A status code other than OK
-  // and ERR_IO_PENDING will cancel the request and report the status code as
-  // the reason.
+  // being fetched by modifying |new_url|. If set, the URL must be valid. The
+  // reference fragment from the original URL is not automatically appended to
+  // |new_url|; callers are responsible for copying the reference fragment if
+  // desired.
+  // |callback| and |new_url| are valid only until OnURLRequestDestroyed is
+  // called for this request. Returns a net status code, generally either OK to
+  // continue with the request or ERR_IO_PENDING if the result is not ready yet.
+  // A status code other than OK and ERR_IO_PENDING will cancel the request and
+  // report the status code as the reason.
   //
   // The default implementation returns OK (continue with request).
   virtual int OnBeforeURLRequest(URLRequest* request,
@@ -134,6 +137,11 @@ class NET_EXPORT NetworkDelegate : public base::NonThreadSafe {
   // network, these must not be modified. |override_response_headers| can be set
   // to new values, that should be considered as overriding
   // |original_response_headers|.
+  // If the response is a redirect, and the Location response header value is
+  // identical to |allowed_unsafe_redirect_url|, then the redirect is never
+  // blocked and the reference fragment is not copied from the original URL
+  // to the redirection target.
+  //
   // |callback|, |original_response_headers|, and |override_response_headers|
   // are only valid until OnURLRequestDestroyed is called for this request.
   // See OnBeforeURLRequest for return value description. Returns OK by default.