Fix a bug in origin header generation for CORS preflight in extensions

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

Index: third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
index f40059a0706314776004806d369f3b2c0017ff7b..23b363fb63cfc79b194f9c32e8146f104b14a8b4 100644
--- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
@@ -388,16 +388,15 @@ void DocumentThreadableLoader::makeCrossOriginAccessRequest(
             effectiveAllowCredentials(), crossOriginRequest.httpMethod(),
             crossOriginRequest.httpHeaderFields());
     if (canSkipPreflight && !shouldForcePreflight) {
-      if (getSecurityOrigin())
-        crossOriginRequest.setHTTPOrigin(getSecurityOrigin());
-      if (m_overrideReferrer)
-        crossOriginRequest.setHTTPReferrer(m_referrerAfterRedirect);
-
       prepareCrossOriginRequest(crossOriginRequest);
       loadRequest(crossOriginRequest, crossOriginOptions);
     } else {
-      ResourceRequest preflightRequest = createAccessControlPreflightRequest(
-          crossOriginRequest, getSecurityOrigin());
+      ResourceRequest preflightRequest =
+          createAccessControlPreflightRequest(crossOriginRequest);
+      // TODO: Call prepareCrossOriginRequest(preflightRequest) to also set the

[yhirano, 2017/01/18 05:28:03]

TODO(tyoshino)

[tyoshino (SeeGerritForStatus), 2017/01/18 06:53:42]

Done.

+      // referrer header.
+      if (getSecurityOrigin())
+        preflightRequest.setHTTPOrigin(getSecurityOrigin());
 
       // Create a ResourceLoaderOptions for preflight.
       ResourceLoaderOptions preflightOptions = crossOriginOptions;
@@ -406,7 +405,6 @@ void DocumentThreadableLoader::makeCrossOriginAccessRequest(
       m_actualRequest = crossOriginRequest;
       m_actualOptions = crossOriginOptions;
 
-      prepareCrossOriginRequest(crossOriginRequest);
       loadRequest(preflightRequest, preflightOptions);
     }
   }