Fix a bug in origin header generation for CORS preflight in extensions

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 437 matching lines @@
 
     bool shouldForcePreflight =
         request.isExternalRequest() ||
         InspectorInstrumentation::shouldForceCORSPreflight(m_document);
     bool canSkipPreflight =
         CrossOriginPreflightResultCache::shared().canSkipPreflight(
             getSecurityOrigin()->toString(), crossOriginRequest.url(),
             effectiveAllowCredentials(), crossOriginRequest.httpMethod(),
             crossOriginRequest.httpHeaderFields());
     if (canSkipPreflight && !shouldForcePreflight) {
-      if (getSecurityOrigin())
-        crossOriginRequest.setHTTPOrigin(getSecurityOrigin());
-      if (m_overrideReferrer)
-        crossOriginRequest.setHTTPReferrer(m_referrerAfterRedirect);
-
       prepareCrossOriginRequest(crossOriginRequest);
       loadRequest(crossOriginRequest, crossOriginOptions);
     } else {
-      ResourceRequest preflightRequest = createAccessControlPreflightRequest(
-          crossOriginRequest, getSecurityOrigin());
+      ResourceRequest preflightRequest =
+          createAccessControlPreflightRequest(crossOriginRequest);
+      // TODO(tyoshino): Call prepareCrossOriginRequest(preflightRequest) to
+      // also set the referrer header.
+      if (getSecurityOrigin())
+        preflightRequest.setHTTPOrigin(getSecurityOrigin());
 
       // Create a ResourceLoaderOptions for preflight.
       ResourceLoaderOptions preflightOptions = crossOriginOptions;
       preflightOptions.allowCredentials = DoNotAllowStoredCredentials;
 
       m_actualRequest = crossOriginRequest;
       m_actualOptions = crossOriginOptions;
 
-      prepareCrossOriginRequest(crossOriginRequest);
       loadRequest(preflightRequest, preflightOptions);
     }
   }
 }
 
 DocumentThreadableLoader::~DocumentThreadableLoader() {
   if (m_client) {
     auto clientSpec = m_clientSpec;
     WTF::debug::alias(&clientSpec);
     switch (m_clientSpec) {
@@ skipping 761 matching lines @@
 }
 
 DEFINE_TRACE(DocumentThreadableLoader) {
   visitor->trace(m_resource);
   visitor->trace(m_document);
   ThreadableLoader::trace(visitor);
   RawResourceClient::trace(visitor);
 }
 
 }  // namespace blink