Fix for cross-origin video check for webgl on android

media/base/android/java/src/org/chromium/media/MediaPlayerBridge.java

Index: media/base/android/java/src/org/chromium/media/MediaPlayerBridge.java
diff --git a/media/base/android/java/src/org/chromium/media/MediaPlayerBridge.java b/media/base/android/java/src/org/chromium/media/MediaPlayerBridge.java
index 3de39cd80061fde7e83ea5955d3f5008bf9a1b57..a229cacd5ec3d6bcc867b6b04ec633617eb94540 100644
--- a/media/base/android/java/src/org/chromium/media/MediaPlayerBridge.java
+++ b/media/base/android/java/src/org/chromium/media/MediaPlayerBridge.java
@@ -8,6 +8,7 @@ import android.content.Context;
 import android.media.MediaPlayer;
 import android.net.Uri;
 import android.os.AsyncTask;
+import android.os.Build;
 import android.text.TextUtils;
 import android.util.Base64;
 import android.util.Base64InputStream;
@@ -137,12 +138,20 @@ public class MediaPlayerBridge {
 
     @CalledByNative
     protected boolean setDataSource(
-            Context context, String url, String cookies, String userAgent, boolean hideUrlLog) {
+            Context context, String url, String cookies, String userAgent, boolean hideUrlLog,
+            boolean hasSingleSecurityOrigin) {
         Uri uri = Uri.parse(url);
         HashMap<String, String> headersMap = new HashMap<String, String>();
         if (hideUrlLog) headersMap.put("x-hide-urls-from-log", "true");
         if (!TextUtils.isEmpty(cookies)) headersMap.put("Cookie", cookies);
         if (!TextUtils.isEmpty(userAgent)) headersMap.put("User-Agent", userAgent);
+        // The security origin check is enforced for devices above K. For devices below K,
+        // the security impact is incomparable to the webgl issue it causes. Eventually, the

[Ken Russell (switch to Gerrit), 2014/07/30 20:44:05]

This comment is a little out of date now. Instead, say that for devices below K,
if the HTTP request for the media was made anonymously (no cookies) then it may
be considered same-origin. Note that if the server rejects the request (no
"Access-Control-Allow-Origin: *" response header) we must not consider it
same-origin.

[qinmin, 2014/07/30 23:46:05]

Done.

+        // issue will be resolved when most devices update to the latest version.
+        // http://crbug.com/358198.
+        if (hasSingleSecurityOrigin && Build.VERSION.SDK_INT > Build.VERSION_CODES.KITKAT) {
+            headersMap.put("allow-cross-domain-redirect", "false");
+        }
         try {
             getLocalPlayer().setDataSource(context, uri, headersMap);
             return true;