Apply document's referrer policy on client-initiated reload

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 150 matching lines @@
   ResourceRequest request =
       resourceRequestFromHistoryItem(m_currentItem.get(), cachePolicy);
 
   // ClientRedirectPolicy is an indication that this load was triggered by some
   // direct interaction with the page. If this reload is not a client redirect,
   // we should reuse the referrer from the original load of the current
   // document. If this reload is a client redirect (e.g., location.reload()), it
   // was initiated by something in the current document and should therefore
   // show the current document's url as the referrer.
   if (clientRedirectPolicy == ClientRedirectPolicy::ClientRedirect) {
-    request.setHTTPReferrer(Referrer(m_frame->document()->outgoingReferrer(),
-                                     m_frame->document()->getReferrerPolicy()));
+    request.setHTTPReferrer(SecurityPolicy::generateReferrer(
+        m_frame->document()->getReferrerPolicy(), m_frame->document()->url(),
+        m_frame->document()->outgoingReferrer()));
   }
 
   if (!overrideURL.isEmpty()) {
     request.setURL(overrideURL);
     request.clearHTTPReferrer();
   }
   request.setSkipServiceWorker(frameLoadType ==
                                        FrameLoadTypeReloadBypassingCache
                                    ? WebURLRequest::SkipServiceWorker::All
                                    : WebURLRequest::SkipServiceWorker::None);
@@ skipping 1753 matching lines @@
                          m_documentLoader ? m_documentLoader->url() : String());
   return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const {
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this,
                                       toTracedValue());
 }
 
 }  // namespace blink