[ServiceWorker] Make fetch() method better conformance with the spec.

Source/core/loader/DocumentThreadableLoader.cpp

Index: Source/core/loader/DocumentThreadableLoader.cpp
diff --git a/Source/core/loader/DocumentThreadableLoader.cpp b/Source/core/loader/DocumentThreadableLoader.cpp
index 34c86a52a5fb88db350b7f51faee097dd2028d26..7f5ff3b7272a6ec36badbfad63e143c071ae0a9f 100644
--- a/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/Source/core/loader/DocumentThreadableLoader.cpp
@@ -186,6 +186,15 @@ void DocumentThreadableLoader::redirectReceived(Resource* resource, ResourceRequ
     ASSERT_UNUSED(resource, resource == this->resource());
 
     RefPtr<DocumentThreadableLoader> protect(this);
+
+    // We don't support redirect in Fech API yet.
+    // FIXME: Support redirect in Fech API.
+    if (resource->resourceRequest().requestContext() == blink::WebURLRequest::RequestContextFetch) {
+        m_client->didFailRedirectCheck();
+        request = ResourceRequest();
+        return;
+    }
+
     if (!isAllowedByPolicy(request.url())) {
         m_client->didFailRedirectCheck();
         request = ResourceRequest();
@@ -322,9 +331,22 @@ void DocumentThreadableLoader::handleResponse(unsigned long identifier, const Re
         return;
     }
 
-    // FIXME: When response.wasFetchedViaServiceWorker() is true, we need to check the URL of the response for CSP and CORS.
-
-    if (!m_sameOriginRequest && m_options.crossOriginRequestPolicy == UseAccessControl) {
+    // If the response is fetched via ServiceWorker, the original URL of the response could be different from the URL of the request.
+    bool isCrossOriginResponse = false;
+    if (response.wasFetchedViaServiceWorker()) {

[yhirano, 2014/07/23 05:17:12]

Just curious, why can't we use
this->resource()->resourceRequest().requestContext() ==
blink::WebURLRequest::RequestContextFetch

? What is the difference between them?

+        if (!isAllowedByPolicy(response.url())) {
+            m_client->didFailRedirectCheck();
+            return;
+        }
+        isCrossOriginResponse = !securityOrigin()->canRequest(response.url());
+        if (m_options.crossOriginRequestPolicy == DenyCrossOriginRequests && isCrossOriginResponse) {
+            m_client->didFail(ResourceError(errorDomainBlinkInternal, 0, response.url().string(), "Cross origin requests are not supported."));
+            return;
+        }
+    } else {
+        isCrossOriginResponse = !m_sameOriginRequest;
+    }
+    if (isCrossOriginResponse && m_options.crossOriginRequestPolicy == UseAccessControl) {
         String accessControlErrorDescription;
         if (!passesAccessControlCheck(response, effectiveAllowCredentials(), securityOrigin(), accessControlErrorDescription)) {
             m_client->didFailAccessControlCheck(ResourceError(errorDomainBlinkInternal, 0, response.url().string(), accessControlErrorDescription));