For media element fetches, remove user:pass components always.

Source/core/html/HTMLMediaElement.cpp

Index: Source/core/html/HTMLMediaElement.cpp
diff --git a/Source/core/html/HTMLMediaElement.cpp b/Source/core/html/HTMLMediaElement.cpp
index 5989e22687f9677f46374eca682cd28eec45fbd8..b5a4ccfdc63f4dd87dbdd34dd6298870ac6b1a0d 100644
--- a/Source/core/html/HTMLMediaElement.cpp
+++ b/Source/core/html/HTMLMediaElement.cpp
@@ -870,11 +870,10 @@ void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType, c
     if (attemptLoad && canLoadURL(url, contentType, keySystem)) {
         ASSERT(!webMediaPlayer());
 
-        if (m_preload == MediaPlayer::None) {
+        if (m_preload == MediaPlayer::None)
             m_delayingLoadForPreloadNone = true;
-        } else {
-            m_player->load(loadType(), m_currentSrc, corsMode());
-        }
+        else
+            startLoad();

[acolwell GONE FROM CHROMIUM, 2014/05/16 17:32:19]

nit: s/startLoad/startPlayerLoad/ just to make it clear that this isn't
referring to the HTMLMediaElement load()

[sof, 2014/05/16 19:51:31]

That's a clearer name, thanks.

     } else {
         mediaLoadingFailed(MediaPlayer::FormatError);
     }
@@ -887,6 +886,24 @@ void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType, c
         renderer()->updateFromElement();
 }
 
+void HTMLMediaElement::startLoad()
+{
+    // Filter out user:pass as the information isn't supplied for
+    // media resource fetches (including CORS use-credentials).
+    // Compatible behavior, and what the embedder currently does

[Nate Chapin, 2014/05/16 16:55:36]

Grammar Nit: I'm not 100% sure I've read this correctly. Should this be "This is
compatible behavior, ...", referring to the last sentence?

[sof, 2014/05/16 19:51:31]

I tried to make the comment minimal, but compressed it too much, I suppose.
Expanded it a bit, and hopefully also clearer.

+    // regardless.

[acolwell GONE FROM CHROMIUM, 2014/05/16 17:32:19]

Please put relevant spec references for this behavior.

[sof, 2014/05/16 19:51:31]

Done, but the treatment of these URL forms isn't (yet) covered by the spec.
Fetch does cover this, we just have to wait for the HTML spec to "fetch-ify" its
various resource fetch algorithms. Expanded the FIXME to make that clear.

+    //
+    // FIXME: when the spec switches to being Fetch-based, and
+    // explicitly sets the authentication flag, adjust handling.
+    KURL requestURL = m_currentSrc;
+    if (!requestURL.user().isEmpty())
+        requestURL.setUser(String());
+    if (!requestURL.pass().isEmpty())
+        requestURL.setPass(String());
+
+    m_player->load(loadType(), requestURL, corsMode());
+}
+
 void HTMLMediaElement::setPlayerPreload()
 {
     m_player->setPreload(m_preload);
@@ -901,7 +918,7 @@ void HTMLMediaElement::startDelayedLoad()
 
     m_delayingLoadForPreloadNone = false;
 
-    m_player->load(loadType(), m_currentSrc, corsMode());
+    startLoad();
 }
 
 WebMediaPlayer::LoadType HTMLMediaElement::loadType() const