Leave out empty-valued Access-Control-Request-Headers: on preflights.

third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 52 matching lines @@
       continue;
     }
     if (equalIgnoringCase(header.key, "referer")) {
       // When the request is from a Worker, referrer header was added by
       // WorkerThreadableLoader. But it should not be added to
       // Access-Control-Request-Headers header.
       continue;
     }
     filteredHeaders.push_back(header.key.lower());
   }
+  if (!filteredHeaders.size())
+    return nullAtom;
 
   // Sort header names lexicographically.
   std::sort(filteredHeaders.begin(), filteredHeaders.end(),
             WTF::codePointCompareLessThan);
   StringBuilder headerBuffer;
   for (const String& header : filteredHeaders) {
     if (!headerBuffer.isEmpty())
       headerBuffer.append(",");
     headerBuffer.append(header);
   }
@@ skipping 16 matching lines @@
                                       AtomicString(request.httpMethod()));
   preflightRequest.setPriority(request.priority());
   preflightRequest.setRequestContext(request.requestContext());
   preflightRequest.setSkipServiceWorker(WebURLRequest::SkipServiceWorker::All);
 
   if (request.isExternalRequest()) {
     preflightRequest.setHTTPHeaderField(
         HTTPNames::Access_Control_Request_External, "true");
   }
 
-  if (request.httpHeaderFields().size() > 0) {
-    preflightRequest.setHTTPHeaderField(
-        HTTPNames::Access_Control_Request_Headers,
-        createAccessControlRequestHeadersHeader(request.httpHeaderFields()));
+  if (request.httpHeaderFields().size()) {

[yhirano, 2017/01/18 05:41:55]

Do we need this outer branch?

[sof, 2017/01/18 06:57:48]

It almost always holds, i reckon & the extra code it executes isn't worth losing
sleep over, so removed.

+    AtomicString headers =
+        createAccessControlRequestHeadersHeader(request.httpHeaderFields());
+    if (headers != nullAtom) {
+      preflightRequest.setHTTPHeaderField(
+          HTTPNames::Access_Control_Request_Headers, headers);
+    }
   }
 
   return preflightRequest;
 }
 
 static bool isOriginSeparator(UChar ch) {
   return isASCIISpace(ch) || ch == ',';
 }
 
 static bool isInterestingStatusCode(int statusCode) {
@@ skipping 407 matching lines @@
     //
     // This is equivalent to the step 2 in
     // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch
     if (options.credentialsRequested == ClientDidNotRequestCredentials)
       options.allowCredentials = DoNotAllowStoredCredentials;
   }
   return true;
 }
 
 }  // namespace blink