Set 'ResourceRequest::requestorOrigin' in Blink for more request types.

third_party/WebKit/Source/core/loader/FrameLoadRequest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/loader/FrameLoadRequest.h"
 
 #include "platform/network/ResourceRequest.h"
 #include "public/platform/WebURLRequest.h"
 #include "wtf/text/AtomicString.h"
 
@@ skipping 35 matching lines @@
     , m_shouldSetOpener(MaybeSetOpener)
     , m_shouldCheckMainWorldContentSecurityPolicy(shouldCheckMainWorldContentSecurityPolicy)
 {
     // These flags are passed to a service worker which controls the page.
     m_resourceRequest.setFetchRequestMode(WebURLRequest::FetchRequestModeNavigate);
     m_resourceRequest.setFetchCredentialsMode(WebURLRequest::FetchCredentialsModeInclude);
     m_resourceRequest.setFetchRedirectMode(WebURLRequest::FetchRedirectModeManual);
 
     if (originDocument) {
         m_resourceRequest.setRequestorOrigin(SecurityOrigin::create(originDocument->url()));
-    } else {
-        if (m_resourceRequest.frameType() == WebURLRequest::FrameTypeTopLevel) {
-            m_resourceRequest.setRequestorOrigin(SecurityOrigin::create(resourceRequest.url()));
-        }
+        return;
+    }
+
+    // If we don't have an origin document, and we're going to throw away the response data
+    // regardless, set the requestor to a unique origin.
+    if (m_substituteData.isValid()) {
+        m_resourceRequest.setRequestorOrigin(SecurityOrigin::createUnique());
+        return;
+    }
+
+    // If we're dealing with a top-level request, use the origin of the requested URL as the initiator.
+    //
+    // TODO(mkwst): This should be `nullptr`. https://crbug.com/625969
+    if (m_resourceRequest.frameType() == WebURLRequest::FrameTypeTopLevel) {
+        m_resourceRequest.setRequestorOrigin(SecurityOrigin::create(resourceRequest.url()));
+        return;
     }
 }
 
 } // namespace blink