This fixes http://code.google.com/p/chromium/issues/detail?id=3585, which is ...

webkit/glue/webplugin_impl.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 
 #include "base/compiler_specific.h"
 
 MSVC_PUSH_WARNING_LEVEL(0);
 #include "Cursor.h"
@@ skipping 240 matching lines @@
 }
 
 WebCore::Widget* WebPluginImpl::Create(const GURL& url,
                                        char** argn,
                                        char** argv,
                                        int argc,
                                        WebCore::Element *element,
                                        WebFrameImpl *frame,
                                        WebPluginDelegate* delegate,
                                        bool load_manually) {
-  WebPluginImpl* webplugin = new WebPluginImpl(element, frame, delegate, url);
+  WebPluginImpl* webplugin = new WebPluginImpl(element, frame, delegate, url,
+                                               load_manually);
 
   if (!delegate->Initialize(url, argn, argv, argc, webplugin, load_manually)) {
     delegate->PluginDestroyed();
     delegate = NULL;
     delete webplugin;
     return NULL;
   }
 
   WebPluginContainer* container = new WebPluginContainer(webplugin);
   webplugin->SetContainer(container);
   return container;
 }
 
 WebPluginImpl::WebPluginImpl(WebCore::Element* element,
                              WebFrameImpl* webframe,
                              WebPluginDelegate* delegate,
-                             const GURL& plugin_url)
+                             const GURL& plugin_url,
+                             bool load_manually)
     : windowless_(false),
       window_(NULL),
       element_(element),
       webframe_(webframe),
       delegate_(delegate),
       force_geometry_update_(false),
       visible_(false),
       received_first_paint_notification_(false),
       widget_(NULL),
-      plugin_url_(plugin_url) {
+      plugin_url_(plugin_url),
+      load_manually_(load_manually),
+      first_geometry_update_(true) {
 }
 
 WebPluginImpl::~WebPluginImpl() {
 }
 
 void WebPluginImpl::SetWindow(HWND window, HANDLE pump_messages_event) {
   if (window) {
     DCHECK(!windowless_);  // Make sure not called twice.
     window_ = window;
   } else {
@@ skipping 339 matching lines @@
   delegate_->UpdateGeometry(
       webkit_glue::FromIntRect(window_rect),
       webkit_glue::FromIntRect(clip_rect), cutout_rects,
       received_first_paint_notification_? visible_ : false);
 
   // delegate_ can go away as a result of above call, so check it first.
   if (force_geometry_update_ && delegate_) {
     force_geometry_update_ = false;
     delegate_->FlushGeometryUpdates();
   }
+
+  // Initiate a download on the plugin url. This should be done for the
+  // first update geometry sequence.
+  if (first_geometry_update_) {
+    first_geometry_update_ = false;
+    // An empty url corresponds to an EMBED tag with no src attribute.
+    if (!load_manually_ && plugin_url_.is_valid()) {
+      HandleURLRequestInternal("GET", false, NULL, 0, NULL, false, false,
+                               plugin_url_.spec().c_str(), NULL, false,
+                               false);
+    }
+  }
 }
 
 void WebPluginImpl::paint(WebCore::GraphicsContext* gc,
                           const WebCore::IntRect& damage_rect) {
   if (gc->paintingDisabled())
     return;
 
   if (!parent())
     return;
 
@@ skipping 439 matching lines @@
     cutout_rects->push_back(r);
   }
 }
 
 void WebPluginImpl::HandleURLRequest(const char *method,
                                      bool is_javascript_url,
                                      const char* target, unsigned int len,
                                      const char* buf, bool is_file_data,
                                      bool notify, const char* url,
                                      void* notify_data, bool popups_allowed) {
+  HandleURLRequestInternal(method, is_javascript_url, target, len, buf,
+                           is_file_data, notify, url, notify_data,
+                           popups_allowed, true);
+}
+
+void WebPluginImpl::HandleURLRequestInternal(
+    const char *method, bool is_javascript_url, const char* target,
+    unsigned int len, const char* buf, bool is_file_data, bool notify,
+    const char* url, void* notify_data, bool popups_allowed,
+    bool use_plugin_src_as_referrer) {
   // For this request, we either route the output to a frame
   // because a target has been specified, or we handle the request
   // here, i.e. by executing the script if it is a javascript url
   // or by initiating a download on the URL, etc. There is one special
   // case in that the request is a javascript url and the target is "_self",
   // in which case we route the output to the plugin rather than routing it
   // to the plugin's frame.
   GURL complete_url;
   int routing_status = RouteToFrame(method, is_javascript_url, target, len,
                                     buf, is_file_data, notify, url,
@@ skipping 29 matching lines @@
 
     // If the RouteToFrame call returned a failure then inform the result
     // back to the plugin asynchronously.
     if ((routing_status == INVALID_URL) ||
         (routing_status == GENERAL_FAILURE)) {
       resource_client->DidFail();
       return;
     }
 
     InitiateHTTPRequest(resource_id, resource_client, method, buf, len,
-                        GURL(complete_url_string), NULL);
+                        GURL(complete_url_string), NULL,
+                        use_plugin_src_as_referrer);
   }
 }
 
 int WebPluginImpl::GetNextResourceId() {
   static int next_id = 0;
   return ++next_id;
 }
 
 bool WebPluginImpl::InitiateHTTPRequest(int resource_id,
                                         WebPluginResourceClient* client,
                                         const char* method, const char* buf,
                                         int buf_len,
                                         const GURL& url,
-                                        const char* range_info) {
+                                        const char* range_info,
+                                        bool use_plugin_src_as_referrer) {
   if (!client) {
     NOTREACHED();
     return false;
   }
 
   WebCore::KURL kurl = webkit_glue::GURLToKURL(url);
 
   ClientInfo info;
   info.id = resource_id;
   info.client = client;
   info.request.setFrame(frame());
   info.request.setURL(kurl);
   info.request.setOriginPid(delegate_->GetProcessId());
   info.request.setResourceType(ResourceType::OBJECT);
   info.request.setHTTPMethod(method);
 
   if (range_info)
     info.request.addHTTPHeaderField("Range", range_info);
 
   WebCore::String referrer;
-  // If the plugin is instantiated without a SRC URL, then use the
-  // containing frame URL as the referrer.
-  if (plugin_url_.spec().empty()) {
+  // GetURL/PostURL requests initiated explicitly by plugins should specify the
+  // plugin SRC url as the referrer if it is available.
+  if (use_plugin_src_as_referrer && !plugin_url_.spec().empty()) {
+    referrer = webkit_glue::StdStringToString(plugin_url_.spec());
+  } else { 
     referrer = frame()->loader()->outgoingReferrer();
-  } else {
-    referrer = webkit_glue::StdStringToString(plugin_url_.spec());
   }
 
   if (!WebCore::FrameLoader::shouldHideReferrer(kurl, referrer))
     info.request.setHTTPReferrer(referrer);
 
   if (strcmp(method, "POST") == 0) {
     // Adds headers or form data to a request.  This must be called before
     // we initiate the actual request.
     SetPostData(&info.request, buf, buf_len);
   }
@@ skipping 19 matching lines @@
                                              HANDLE notify_data) {
   int resource_id = GetNextResourceId();
   std::string complete_url_string;
   CompleteURL(url, &complete_url_string);
 
   WebPluginResourceClient* resource_client =
       delegate_->CreateResourceClient(resource_id, complete_url_string,
                                       notify_needed, notify_data,
                                       existing_stream);
   InitiateHTTPRequest(resource_id, resource_client, "GET", NULL, 0,
-                      GURL(complete_url_string), range_info);
+                      GURL(complete_url_string), range_info, true);
 }
 
 void WebPluginImpl::HandleHttpMultipartResponse(
     const WebCore::ResourceResponse& response,
     WebPluginResourceClient* client) {
   std::string multipart_boundary;
   if (!MultipartResponseDelegate::ReadMultipartBoundary(
           response, &multipart_boundary)) {
     NOTREACHED();
     return;
   }
 
   MultiPartResponseClient* multi_part_response_client =
       new MultiPartResponseClient(client);
 
   MultipartResponseDelegate* multi_part_response_handler =
       new MultipartResponseDelegate(multi_part_response_client, NULL,
                                     response,
                                     multipart_boundary);
   multi_part_response_map_[client] = multi_part_response_handler;
 }