| Index: third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
 | 
| diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
 | 
| index 63648694e9d0ef4a99377b39f17c75c492eb2544..a4e370a5970efa32ddd1d59a5374ab43f7031f88 100644
 | 
| --- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
 | 
| +++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
 | 
| @@ -415,7 +415,7 @@ void DocumentThreadableLoader::clear()
 | 
|  // RawResource::didAddClient(), clearing |request| won't be propagated
 | 
|  // to content::WebURLLoaderImpl. So, this loader must also get detached from
 | 
|  // the resource by calling clearResource().
 | 
| -void DocumentThreadableLoader::redirectReceived(Resource* resource, ResourceRequest& request, const ResourceResponse& redirectResponse)
 | 
| +bool DocumentThreadableLoader::redirectReceived(Resource* resource, const ResourceRequest& request, const ResourceResponse& redirectResponse)
 | 
|  {
 | 
|      DCHECK(m_client);
 | 
|      DCHECK_EQ(resource, this->resource());
 | 
| @@ -428,9 +428,7 @@ void DocumentThreadableLoader::redirectReceived(Resource* resource, ResourceRequ
 | 
|  
 | 
|          handlePreflightFailure(redirectResponse.url().getString(), "Response for preflight is invalid (redirect)");
 | 
|  
 | 
| -        request = ResourceRequest();
 | 
| -
 | 
| -        return;
 | 
| +        return false;
 | 
|      }
 | 
|  
 | 
|      if (m_redirectMode == WebURLRequest::FetchRedirectModeManual) {
 | 
| @@ -451,9 +449,7 @@ void DocumentThreadableLoader::redirectReceived(Resource* resource, ResourceRequ
 | 
|              notifyFinished(resource);
 | 
|          }
 | 
|  
 | 
| -        request = ResourceRequest();
 | 
| -
 | 
| -        return;
 | 
| +        return false;
 | 
|      }
 | 
|  
 | 
|      if (m_redirectMode == WebURLRequest::FetchRedirectModeError) {
 | 
| @@ -461,24 +457,21 @@ void DocumentThreadableLoader::redirectReceived(Resource* resource, ResourceRequ
 | 
|          clear();
 | 
|          client->didFailRedirectCheck();
 | 
|  
 | 
| -        request = ResourceRequest();
 | 
| -
 | 
| -        return;
 | 
| +        return false;
 | 
|      }
 | 
|  
 | 
|      // Allow same origin requests to continue after allowing clients to audit the redirect.
 | 
|      if (isAllowedRedirect(request.url())) {
 | 
|          if (m_client->isDocumentThreadableLoaderClient())
 | 
| -            static_cast<DocumentThreadableLoaderClient*>(m_client)->willFollowRedirect(request, redirectResponse);
 | 
| -        return;
 | 
| +            return static_cast<DocumentThreadableLoaderClient*>(m_client)->willFollowRedirect(request, redirectResponse);
 | 
| +        return true;
 | 
|      }
 | 
|  
 | 
|      if (m_corsRedirectLimit <= 0) {
 | 
|          ThreadableLoaderClient* client = m_client;
 | 
|          clear();
 | 
|          client->didFailRedirectCheck();
 | 
| -        request = ResourceRequest();
 | 
| -        return;
 | 
| +        return false;
 | 
|      }
 | 
|  
 | 
|      --m_corsRedirectLimit;
 | 
| @@ -506,8 +499,7 @@ void DocumentThreadableLoader::redirectReceived(Resource* resource, ResourceRequ
 | 
|          ThreadableLoaderClient* client = m_client;
 | 
|          clear();
 | 
|          client->didFailAccessControlCheck(ResourceError(errorDomainBlinkInternal, 0, redirectResponse.url().getString(), accessControlErrorDescription));
 | 
| -        request = ResourceRequest();
 | 
| -        return;
 | 
| +        return false;
 | 
|      }
 | 
|  
 | 
|      // FIXME: consider combining this with CORS redirect handling performed by
 | 
| @@ -535,15 +527,19 @@ void DocumentThreadableLoader::redirectReceived(Resource* resource, ResourceRequ
 | 
|      m_didRedirect = true;
 | 
|      m_referrerAfterRedirect = Referrer(request.httpReferrer(), request.getReferrerPolicy());
 | 
|  
 | 
| +    ResourceRequest crossOriginRequest(request);
 | 
| +
 | 
|      // Remove any headers that may have been added by the network layer that cause access control to fail.
 | 
| -    request.clearHTTPReferrer();
 | 
| -    request.clearHTTPOrigin();
 | 
| -    request.clearHTTPUserAgent();
 | 
| +    crossOriginRequest.clearHTTPReferrer();
 | 
| +    crossOriginRequest.clearHTTPOrigin();
 | 
| +    crossOriginRequest.clearHTTPUserAgent();
 | 
|      // Add any CORS simple request headers which we previously saved from the original request.
 | 
|      for (const auto& header : m_simpleRequestHeaders)
 | 
| -        request.setHTTPHeaderField(header.key, header.value);
 | 
| -    makeCrossOriginAccessRequest(request);
 | 
| +        crossOriginRequest.setHTTPHeaderField(header.key, header.value);
 | 
| +    makeCrossOriginAccessRequest(crossOriginRequest);
 | 
|      // |this| may be dead here.
 | 
| +
 | 
| +    return true;
 | 
|  }
 | 
|  
 | 
|  void DocumentThreadableLoader::redirectBlocked()
 | 
| 
 |